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You have a 

LEGAL RIGHT 

to an unlocked 

backup copy 

of your 

commercial 
software 



Our editorial policy is that we do NOT condone 
software piracy, but we do believe that users are entitled 
to backup commercial disks they have purchased. 

In addition to the security of a backup disk, the removal 
of copy-protection gives the user the option of modifying 
programs to meet his or her needs. 

Furthermore, the copyright laws guarantee your right 
to such a DEPROTECTED backup copy: 



..."It is not an infringement for the owner of a copy of 
a computer program to make or authorize the making of 
another copy or adaptation of that computer program 
provided: 

1) that such a new copy or adaptation is created as an 
essential step in the utilization of the computer program in 
conjunction with a machine and that it is used in no other 
manner, or 

2) that such new copy or adaptation is for archival 
purposes only and that all archival copies are destroyed in 
the event that continued possession of the computer program 
should cease to be rightful. 

Any exact copies prepared in accordance with the 
provisions of this section may be leased, sold, or otherwise 
transferred, along with the copy from which such copies 
were prepared, only as part of the lease, sale, or other 
transfer of all rights in the program. Adaptations so prepared 
may be transferred only with the authorization of the 
copyright owner." 



United States Code title 17, §117 



COMPUTIST 



Publisher-Editor: Charles R. Haighl 

Graphics Editor: Ben R. Haighl 

Circulation: Karen Fitzpatrick 

Advertising, call: (206) 474-5750 

Publisher; Soft Key Publishing 

Printing: Valco Graphics & Printing 



• Address all advertising inquiries to: 
COMPUTIST; Advertising Department; PO 
Box I 10816; Tacoma, WA 9841 I 

• Mail all RDEX letters to; 

COMPUTIST 

Apple-RDEX or IBM-RDEX 

PO Box I 10846 K 

Tacoma, WA 9841 I 

• COMPUTIST does NOT purchase editorial 
material. The entire editorial content consists 
of information submitted to COMPUTIST for 
publication in the shared interests of all 
COMPUTISTs. 

• Unsolicited material (manuscripts, letters 
to the editor, softkeys, A.P.T.s, playing tips, 
questions, etc., are assumed to be submitted 
as letters-to-the-RDEX- editor for publication 
with all and exclusive rights belonging to 
COMPUTIST. 

• Entire contents copyright 1988 bySoftKey 
Publishing. All rights reserved. Copying done 
for other than personal or internal reference 
(without express written permission from the 
publisher) is prohibited. 

• The volunteer and paid editorial staff 
assume no liability or responsibility for the 
products advertised in the magazine. Any 
opinions expressed by the authors are not 
necessarily those of COMPUTIST magazine, 
its staff or SoftKey Publishing. 

• Apple® is a trademark of Apple 
Computers. IBM® is (he IBM trademark. 

SUBSCRIPTIONS: Rates (for 1 2 issues): 
U.S.-S32 U.S. lstClass-$45 

Canada/Mex.-$45 Other Foreign-$75 

• Send subscription inquiries to; 
COMPUTIST; Subscription Department; PO 
Box II0846-T; Tacoma, WA984II 

• For Domestic Dealer rates: Call (206) 
474-5750 for more information. 

• Change Of Address: Please allow 4 
weeks for change of address to take effect. 
On postal form 3576 supply your new 
address and your most recent address label. 

• Issues missed due to non-receipt of change 
of address may be acquired at the regular 
back issue rate. 



COMPUTIST #57 



July 



Attention Apple-users: 
Why type those 
/-o-n-g listings when 
you can just Upgrade 
your present sub. to a 
Mag/5 VS'Disk Combo 
subscription 

■ You may upgrade your current 
subscription to a magazine & disk 
combination by sending $5,50 ($6.50 
foreign) per remaining issue. 

Time to renew? 

■ Check your mailing label to see if you 
need to renew your subscription. 

C Use the order form on this page to 
renew, and don't forget to send your most 
current mailing label to help expedite your 
renewal 

Moving soon? 

■ If you're moving, let us know at least 30 
days in advance. 

■ Issues missed due to non-reciept of 
Change-of-Address may be acquired at the 
regular back issue rates. 

■ Remember, the Post Office does not 
forward third class mail unless requested. 
COMPUTIST is not responsible for 
replacing issues lost while forwarding order 
is in effect. 
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■ Yes, I want to subscribe to COMPUTIST. Enclosed are funds for an annual (12 issue) subscription. 

I am... H A new subscriber 

□ Renewing my current subscription 

□ Changing my address (please include last mail label) 
I have..G an Apple He, llgs or lie computer 

I - an IBM computer 



Name. 



_ID#. 



Apple— IBM subscription... 
D U.S. - $32 

□ U.S. /Canada /Mexico First Class - $45 

□ All other Foreign ■ $75 

Apple mag-disk combination subscription... 
O U.S./Canada/Mexico First Class plus Library Disk ■ $ 1 00 
P All other Foreign plus Library Disk ■ $ 1 40 

U.S. Funds drawn on U.S. bank. Allow 4—8 weeks for first issue. 



Address 
City 



State 



Zip 



Country. 



_Phone_ 



Exp. 



Signature 
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Notes 'n things 



OOFS! 



Seems that I made a mistake when I told you about the Starter Kit. The cost of the 
starter kit is $2 when ordered separately or if you have already received your free copy. 
Here's the information on the Starter Kit again, with the corrections included. 



I What's a Starter Kit? 

The Starter Kit is a disk with most of the programs (previously published in 
COMPUTIST) that you need to get started with disk '"snooping" and "converting". 
This includes SUPER IOB vl.5 (with STANDARD. CON, FAST. CON, SWAP. CON 
and NEWS WAP. CON), CAPTURE (a routine to convert Applesoft controllers into 
EXECutable text files), DISKEDIT (for direct disk viewing and editing), the NIBBLER 
(for viewing raw data from the disk in nibblized form), the CORE DISK SEARCHER 
(to find byte patterns on the disk), the DOS ALTERER (to make custom DOS changes) 
and CHECKSOFT and CHECKBIN (to generate the checksums that we print so you 
can compare and check for errors in your typing). 



I Where's my Starter Kit? 



If you are a new subscriber, you will receive the Starter Kit automatically. If you 
are renewing and have never received a Starter Kit, ask for the Kit at the same time 
that you send your renewal and it will be sent to you at no extra charge. 



I Starter Kit for $2 

If you are a current subscriber but you're not ready to renew, then send two dollars 
and we'll put the Starter Kit in a bubble pack mailer and sent it to you. You do have 
to be a subscriber. We'll let everyone know when there are significant updates or changes 
to the the Starter Kit. 



BUGS 



COMPUTIST #54, page 21 

See Thomas Purifoy on page 25 
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New COMPUTIST readers using Apple Us 
are advised to read this page carefully to avoid 
frustration when attempting to follow a softkey 
or entering the programs printed in this issue. 

What is a softkey, anyway? 

Softkey is a term which we coined to describe a 
procedure that removes, or at least circumvents, any copy- 
protection on a particular disk. Once a softkey procedure 
has been performed, the resulting backup copy can usually 
be copied by the normal copy programs (for example: 
COPYA, on their DOS 3.3 System Master disk). 

Commands and control keys 

In any article appearing in COMPUTIST, commands 
which a reader is required to perform are set apart by 
being in b oldface and on a separate line. The 
IRETUHMI |( e y mU st be pressed at the end of every 
such command unless otherwise specified. Control 
characters are specially boxed. An example of both is: 

■ fSPl 

Press UU N ext, p lace one finger on the CE3 key 
and then press L gJ Rememb er to enter this command 
line by pressing iRETURHl . 

Other sp ecial combination keypresses include 
iBRESBTl or IQBRESETt | n the form er, press 
and hold down GzED then press I RESET I . | n the 
latter, press and hold down both EE3 and I ti I then 
press I RESET I 

Special requirements 

Special prerequisites for COMPUTIST articles, programs 
and softkeys are usually listed at the start under: 
■ Requirements: 

Software recommendations 

2r Applesoft program editor such as Global Program 
Line Editor (GPLE). 

\Ff Sector-editor such as DiskEdit (in the COMPUTIST 
Starter kit] or ZAP from Bag of Tricks. 

2f Disk-search utility such as The Inspector, the CIA 
or the Core Disk Searcher (in the COMPUTIST Starter 
Kit). 

$f Assembler such as the S-C Assembler from S-C 
software or Merlin/Big Mac. 

\Bf Bit-copy program such as Copy II Plus, Locksmith 
or Essential Data Duplicator (EDO). 

Sr Text-editor (that produces normal sequential text 
files) such as Applewriter II, Magic Window II or 
Screenwriter II. 

DP* COPYA, FID and MUFFIN from the DOS 3.3 
System Master disk are also useful. 



Super IOB and Controllers 

This powerful deprotection utility (in the COMPUTIST 
Starter Kit) and its various Controllers are used in many 
softkeys. (It is also On each Super IOB Collection disk.) 

Reset into the Monitor 

Softkeys occasionally require the user to stop the 
execution of a copy-protected program and directly enter 
the Apple's system monitor. Check the following list to 
see what hardware you will need to obtain this ability. 

Apple II + , lie, compatibles: I ) Place an Integer 
BASfC ROM card in one of the Apple slots. 3) Use a non- 
maskable interrupt (NMI) card such as Replay or Wildcard. 

Apple II -i- , compatibles: I ) Install an H ROM 
with a modified reset-vector on the computer's 
motherboard as detailed in the Modified ROM's article 
(COMPUTIST #6 or Book Of Softkeys III ) or the Dual 
ROM's article (COMPUTIST #19). 

Apple lie, lie: Install a modified CD ROM on the 
computer's motherboard. Cutting Edge Ent. (Box 43234 
Ren Cen Station-HC; Detroit, Ml 48343) sells a hardware 
device that will give you this important ability but it will 
void an Apple //c warranty. 

Recommended literature: 

0* Apple II Reference Manual 

\FfDOS 3.3 manual 

&* Beneath Apple DOS, by Don Worth and Pieter 

Lechner, from Quality Software 
Sr Assembly Language For The Applesoft 

Programmer, by Roy Meyers and C.W. Finley, 

from Addison Wesley 

Keying in Applesoft programs: 

BASIC programs are printed in a format that is designed 
to minimize errors for readers who key in these programs. 
If you type: 

10HOME:REMCLEAR SCREEN 

The LIST will look like: 

10 HOME : REM CLEAR SCREEN 
...because Applesoft inserts spaces into a program listing 
before and after every command word or mathematical 
operator. These spaces usually don't pose a problem 
except in line numbers which contain REM or DATA 
commands. There are two types of spaces: those that have 
to be keyed and those that don't. Spaces that must be 
typed appear in COMPUTIST as delta characters (°). All 
other spaces are there for easier reading. NOTE; tf you 
want your checksums (See Computing checksums) 
to match up, you must key ONLY the 'spaces after DATA 
statements. 



Keying In Hexdumps 

Machine language programs are printed in 
COMPUTIST as hexdumps, sometimes also as source code. 
Hexdumps are the shortest and easiest format to type 
in. You must first enter the monitor: 
CALL -151 

Key in the hexdump exactly as it appears in the 
magazine, ignoring the four-digit checksum ($ and four 
digits) at the end of each line. A beep means you have 
typed something that the monitor didn't understand and 
must, therefore, retype that line. 

When finished, return to BASIC with: 
3D0G 

BSAVE the program with the filename, address and 
length parameters given in the article. 

The source code ts printed to help explain a program's 
operation. To key it in, you will need the S-C Assembler 
or you will have to translate pieces of the source code 
into something your assembler will understand (see table 
of S-C Assembler directives in COMPUTIST #17. 

Computing checksums 

Checksums are 4 -digit hexadecimal numbers which tell 
if you typed a program exactly as it appears in 
COMPUTIST. 

There are two types of checksums: one created by the 
CHECKBIN program (for machine language programs) 
and the other created by the CHECKSOFT program (for 
BASIC programs). Both appeared in COMPUTIST # I and 
The Best of Hardcore Computing. An update to 
CHECKSOFT appeared in COMPUTIST # IS. 

If the published checksums accompanying program 
listings and hexdumps do not match those created by 
your computer, then you typed the program incorrectly. 
The line where the first checksum differs has an error. 

CHECKSOFT instructions: 

LOAD filename 
BRUM CHECKSOFT 

Get the checksums with: I * I and correct the 
program line where the checksums differ. 

CHECKBIN instructions: 

CALL -151 
BLOAD filename 

Install CHECKBIN at an out of the way place 
BRUN CHECKBIN, A$6000 

Get the checksums by typing the Starting address, a 
pe riod a nd the Ending address of the file followed by 

iW.. 
SS$,EEE(3£ 

Correct the lines at which the checksums differ. 
RDEXed 
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when 
writing a 
letter to... 



J\pph RDCXed 



RDEX stands for: 

Reader's Data Exchange 

That means that when you send in 
articles, soft keys, APTs, etc., you are 
submitting them for FREE publication in 
this magazine. RDEX does NOT 
purchase submissions nor do we verify 
data submitted by readers. We will 
print it and it is the responsibility of the 
readers to send in responses when 
anything is wrojng, 

• Remember that your letters or parts 
of them may be used in RDEX even if 
not addressed to the Apple-RDEX editor. 
Correspondence that gets published may 
be edited for clarity, grammcr and space 
requirements . 

• Because of the great number of letters 
we receive and the ephemeral and 
unpredictable appearance of our part- 
time staff, any response to your queries 
will appear only in Apple-RDEX, so it 
would be more appropriate for you to 
present technical questions to the readers 
and ask for their responses which will 
then be placed in the Apple-RDEX. 

Send your articles and letters on 

DOS 3.3 standard text 
files 

When we get your letter- article in a 
standard DOS3.3 text file, it is 
immediately uploaded into the most 
current RDEX file. Conventional letters 
must be typed in by us... when we have 
the time, 

• Address your leuers, articles, to; 

COMPUTIST 

Apple RDEX Editor 

PO Bos 110846-K 

Tacoma, \VA 9841 1 



Bill Wilson 



Slightly embarrassed. That's the only way 
to describe my feelings after reading William 
Green's crack for Game Maker. En a crack I 
developed, it took 31 steps to do what Mr. 
Green has accomplished in a five-byte sector 
edit. Oh well. 

However, I have sent in this crack purely 
for the educational value of it. If anyone wishes 
to deprotcct Came Maker (GM), I heartily 
suggest they use Mr. Green's crack in 
COMPUTIST #50. In the following 
information, you may find various techniques 
and processes of value for future cracking 
attempts. 



Sofikey for.. 



Game Maker 

Activision 



■ Requirements 

D Game Maker disk 

□ Blank disk 

□ A formatted DOS 3.3 slave disk 

□ A sector editor 

D Apple He with at least 64K 

□ One disk drive 

Game Maker (GM) is a useful utility for 
creating customized computer games. Using the 
various editors of GM, one can design 
background hi-rcs graphics screens, animated 
sprites, sound effects, musical scores, and 
program control code. Once a satisfactory game 
has been designed, it may be saved to disk or 
a special disk may be created that automatically 
boots the game, GM, however, suffers from a 
traditional disease that has affected all 
Activision software. It is copy -protected. 

For those of you who are not interested in 
the mechanics of the crack, you can find the 
quick fix for GM in the cookbook instructions. 

On the surface, GM is not copy -protected 
at all . COPY A , the Locksmith Fast Copier, or 
Copy fl Plus' Copy Disk Option will work fine 
on GM. However, when the copy is booted, 
the boot will halt and the user will find himself 
with a locked-up computer. 

When this occurred on my Apple, I used 
my Wildcard software and firmware to sec 
where the lockup (actually an infinite loop) 
occurred. At $8240. I found the instruction 
JMP $8240. This is what was causing the 



computer to lock up. My immediate thought 
was to locate the routine on disk and neutralize 
it with a well -aimed branch to an instruction 
to continue loading. I found the code for 
$8000-82FF on track S21 , sectors $05, $06, 
and $07. (I used the "scan for hex bytes" 
option of Copy II Pius to locate the bytes 4C 
4 82 , thu s kadi ng me to the in fi n ite loop . ) I tried 
to put the bytes EA EA EA (no-operation 
instructions) in the place of the loop. Booting 
the disk, however, produced the same result as 
before. The boot would cease and nothing 
would happen. 

Trying various branches proved to be of 
no avail and only led to the same result with 
the disk refusing to complete a boot cycle. I was 
now convinced there was a fairly sophisticated 
copy-protection routine operating during the 
boot. It became obvious to me the program 
needed something loaded by the routine at 
S8000 to continue loading the program and 
start the utility. I pulled the code for 
S8000-82FF from the disk with Copy II Plus 
and listed it to my printer. 

Using a stripped down version of Don 
Lancaster's "tearing method", I highlighted all 
of the jumps (JMP) and jump to subroutines 
(JSR) in the code. By doing this, along with 
marking the return from subroutines (RTS), one 
can follow the general flow of a program 
without necessarily understanding what it is 
doing at every step of the way . Analyzing the 
code brought out these facts: One, the routine 
exited to SAD00 whether or not the disk check 
was OK. Two, if the disk check was not OK, 
the bytes 4C 40 82 (JMP $8240) were inserted 
at SAD00 prior to jumping there. 

At this point, the user should make a 
COPY A copy of GM, as it will be used later 
in the crack. 

Since the disk check produced something 
that I needed, to boot the disk completely, I 
decided the best way to capture the code at 
SAD00 would be through a boot trace. A boot 
trace is a way of controlling and redirecting a 
disk's boot cycle so that you are in control of 
it at all times. To do this, one must start with 
Boot0, the code in the disk controller card at 
$C600-C6FF. I used these commands to move 
Boot© down to page S9600 so it could be 
modified. 

CALL151 enter the monitor 

960©<C600.C6FFM move Boot® to RAM 

96FA:98 N 98<B1:4C 59 FF redirect boot 

9600G boot the disk 

C0E8 torn off disk drive 

Now, we have captured Bootl, which is 
sitting at $0800-08FF. Wc will move it to 
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$980© so it can be modified and worked with 
to meet our wishes. 

9800 < 800. 8FFM move the coda 

960E:90 adjust so it uses our code at 

$9600 not the ROM at $C600 
984A:4C59FF jump to monitor after Boot 2 bads 
9600G boot the disk 

C0E8 tuta off disk drive 

Boot2 is now captured and sits at $B600- 
BFFF. Again, it wi]] be moved so we can 
modify it. 

4600<B6OO.BFFFM move the code 

984A:4C 00 47 adjust Boot J to jump to 

the now location of boot! 
4741;4C 59 FF add jump to monitor 

960OG boot the disk 

Boot3 (the code at $8000-82FF) has now 
been loaded at $8000. Again, a move and 
modification is in order to further control the 
boot. 

30OQ<8QOO.82FFM move the coda 

4741;4C 00 30 adjust Boot 2 to jump 
to the new location of Boot 3 

303C:30 adjust Boot 3 to work 

30F2:31 at its new location 
313B:3Z 
3227:32 
3242:32 

3269:4C 59 FF add jump to monitor 

9600C boot the disk 

A listing from $AD0O should now reveal 
rational code. This routine is what actually loads 
GM and executes the utility. At this point, the 
Game Maker disk should be removed from the 
drive and a DOS 3.3 formatted disk inserted. 
The DOS 3.3 disk should be a slave disk with 
the DOS image on it and NOT be a DOS 3.3 
master disk. (If you are not familiar with this 
terminology, a slave disk is simply a disk 
formatted with the DOS 3.3 INIT command. 
A DOS 3.3 master disk is made by using the 
Master Create utility.) Now, execute these 
commands from the monitor: 

1D0Q<AD00.B5FFM move code down 

9600G boot the slave disk 

B5AVE GM.LOADER, AglDOO, L$BFF 

At this point, the usual thing to do would 
be to find room for the file on the copied GM 
disk and to make GM.LOADER the "Hello" 
file of the disk. That cannot be done here since 
GM does not use all of DOS 3 .3 and since most 
of the disk is filled with program code and data . 
What we will have to do is find a place for the 
file and adjust Boot 1 to load our GM.LOADER 
instead of the protection routine. A scan of the 
disk with Copy II Plus' "Track/Sector Map" 
utility revealed no free space large enough to 
store the file. However, there are only a few 
large files on the disk. This means the catalog 
track will have some free sectors. As it turns 
out, we can store the file GM.LOADER on 
track $11, sectors $©3-B. 



Here is what the program to do this looks 



like. 

0900 A2 60 LDX 

0902 A9 09 LDA 
0904 ED E0 H7 STA 

0907 A9 11 LDA 

0909 8D15B7 STA 

090C A9 0B LDA 

090E 8D 1A B7 STA 

0911 A9 26 LDA 

0913 8DE7B7 STA 
0916 4C00B7 JMP 



#$60 

#$09 

IB7E0 

#$11 

JB715 

#$0B 

$B71A 

#$26 



X-reg = slot 6 

write 9 pages 

use track $11 

start at set t0B go down 



start page of memory -n 1 

that the RWTS will 
IB7E7 work down from 
SB700 write the data to disk 

Insert the COPYA version of GM into 
drive 1 enter these commands: 
CALL-151 

B72&02 RWTS write cmnd 

B7EB:00 any volume if is OK 

090O:A2 GO A9 09 SB EO B7 A9 
0908:11 BD 15 B7 A9 OB SB 1A 
0910:87 A9 26 8D E7 B7 4C 00 87 
900G 

GM.LOADER will be written to the 
appropriate sectors of track $11, We have the 
captured loader on disk now, but the disk still 
won't boot. Boot© must be modified to load 
GM.LOADER after it has loaded Bootl, and 
Bootl must be modified to jump to 
GM.LOADER instead of jumping to the 
protection routine. We also need to clean up 
the catalog track so we won't get a bunch of 
garbage and disk errors when we catalog the 
disk . Get your sector editor out and make these 
edits to the COPYA version of GM: 



9600G 

C0E8 

4600<B600.BFFFM 

9S4A:4C 00 47 

47«:4C 59 FF 

9600G 

3000<8000.82FFM 

4741:4C 00 30 

3Q3C:30 N 30F2:31 N 313B:32 

3227:32 N 3242:32 

3269:4C 59 FF 

9600G 

1000<ADOO.B5FFM 



I 3 I Insert a DOS 3 . 3 formatted slave disk 
and save the loader to disk in case you glitch 
the softkey. 

C600G 

BSAVE GM.LOADER 



I 4 | Insert the COPYA version of 
Game-Maker. 

CALL-151 

B72G:02 N B7EB:00 

0900:A2 60 A9 09 8D EO B7 A9 

0908:11 8D 15 B7 A9 OB 8D 1A 

0910:87 A9 26 8D E7 B7 4C 00 

0918*7 

900G 



I 5 I Make the following sector edits to 
COPYA version of Game-Maker. 

Trk Set Byte(s) From To 









$00 $00 $4A 
$80 


! 4C 80 08 

' A9098DE0B7A9118D 


$00 $00 $4A 


1 


4C 80 08 


$80 


1 


A9 09 8DE0B7A9118D 
15B7A9 0B8D1AB7A9 




15 B7 A9 0B 80 1A B7 A9 
B6 8DE7B7 4C00B7 






B6 8D E7 87 4C 00 B7 


$00 $01 $15 


11 


$01 $15 


J 


11 


$1A 


0B 


$1A 


i 


0B 


$1F 


B5 


$1F 


7 


B5 


$E0 


09 


$E0 


? 


09 


$11 $0C $01 


00 00 


$11 $0C $01 


1 


00 00 


. , 







With these edits, you now have a COPYA, 
fully functional version of CM. The back side 
of GM may be copied with COPYA. 

Here are the cookbook instructions for 
deprotecting Game-Maker. 

I 1 I Make a COPYA copy of 
Game-Maker. 
CALL-151 

9600<C600,C6FFM 
9GFA:98 N 9801:4C 59 FF 

I 2 | Insert the Game-Maker original disk 
into drive one. 
9600G 
C0E8 

9800<8OO.8FFM 
980E:9O N 984A:4C 59 FF 



I 6 I Copy the back side of Game-Maker 
with COPYA onto another disk and you are 
done. 

Whew! William Green's five-byte sector 
edit sure beats doing all of that. To understand 
why the five-byte sector edit worked, it is 
necessary to examine the protection on Game- 
Maker. The loader at $AD00 is necessary to 
load the main program from the disk. This 
loader is encrypted on disk and the key to 
decrypt it is found through a nibble count. No 
original disk, no decrypted loader. 

By using the boot-trace method to coax the 
decrypted loader from the disk, I captured and 
used it to load the rest of the program. This can 
be considered the "infantry wade-in and take 
no prisoners ' ' brute assault on the nibble count 
to access the protected information. 
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Let's look at a documented version of Mr. 
Green's track, on track $21, sector $©5, 
starting at byte S54: 

A9FF LDA tfSFF $FF is the decrypt key 
18 CLC clear carry to force branch 

90 3D BCC 1 ! branch to the decrypt 
routine 

Mr. Green's tactic was simply to discover 
the decryption key by whatever means, load the 
accumulator with it, and branch to the 
decryption routine. Simple and highly effective. 
To be candid, I had considered this, but could 
not decide on where to branch to into the nibble 
count routine. 

I hope this long softkey will provide an 
example of in-depth disk analysis to beginning 
disk-busters who read COMPUTiST. It 
certainly shows how NOT to crack Game- 
Maker 1 . Yet, it also shows there is more than 
one way to defeat a nibble count, albeit a tedious 
way. 

Softkey Addendum for. . . 



Master Diagnostics He 

Nikrom 



The softkey for Master Diagnostics He 
(MDIIE) as printed in COMPUTIST #52 is not 
complete, and this is my fault. The softkeyed 
disk will work fine unless the disk drive test 
routines are invoked. 

The reason these routines print garbage on 
the screen and bomb out is due to a DOS change 
made by Nikrom. At locations $BA69 (4772 1) 
and $BA7D (47741), Nikrom inserted routines 
that swap disk data marks. They had to; 
otherwise the original MDUE disk would never 
be able to read normally formatted disks to 
conduct the tests. On a disk copied by Super 
lOB, the calls to these locations become logic 
bombs that stop the Apple cold. 

There are several approaches to remedy 
this problem. One, the locations $BA69 and 
SBA7D could be changed to 60 (Return from 
Subroutine) on the DOS of the SIOB'd disk. 
This is not desirable because late versions of 
DOS 3.3 use these locations for their own 
purposes and the person cracking the disk 
should not have to worry about the 3.3 version. 
Two, all of the Applesoft programs these calls 
appear in could be loaded, edited to remove the 
calls, and saved to disk. This would be tedious. 
Three, the calls can be edited on disk to direct 
the call to a location in DOS that already has 
a RTS instruction. This is the best method 1 
found. 

The code to call these routines was CALL 
47741 and CALL 47721. Since ^477" was 
common to both of these instructions, I used 
Copy 11 Plus to scan the disk for the hex bytes 
34 37 37, which is the way Applesoft stored these 
three digits on disk in ASCII. This quickly 



located the sectors in question. I changed the 
last two digits of 47741 and 47721 from 4 1 and 
21 to 33. There is an RTS instruction at location 
47733 (SBA75). Here are the edits to make on 
the SIOB'd version of MDIIE: 



Trk Set Byte{s) From 



Tfl 



$05 $0E $5D 


? 


33 33 


$06 $06 $B1 


? 


33 33 


$08 $9D 


7 


33 33 


$0E $44 


! 


33 33 


$0E $07 $60 


7 


33 33 


$0E $2F 


7 


33 33 


$10 $06 $BE 


7 


33 33 


$DD 


7 


33 33 


$0E $21 


7 


33 33 



Editing these nine sectors will make the 
drive routines fully functional. Sorry about any 
problems this oversight may have caused! One 
final note. In case you have a very early version 
of DOS 3.3, the RTS instruction at SBA75 may 
not exist. In this case, you should redo the 
softkey, this time including a POKE 47733,96 
after the POKE 40514,52 prior to (he copy disk 
initialization. This new POKE ensures an RTS 
instruction will be present at SBA75. 



Joe Walters 



Softkey for. 



Microzine/24 

Scholastic 



A REM statement at line number zero of 
the AnnleSoft program called HELLO contains 
a I QD I followed by FP. This causes the 
program to be erased ill memory if you try lo 
list it. This is easily defeated by removing the 
offending statement since it performs no useful 
function (from our standpoint). 

Secondly, there is a nibble count program 
called CP. OPTIONS that is called from line 
three of the same HELLO program. That too 
can be defeated by simply REMing it out since 
I could not detect any other program making 
use of any output from the nibble count 
program. 

| 1 | Insert side one of Microzinc #24 in 
drive 1 . 

LOAD HELLO 

OREM 

3 POKE (767),2 : REM PRINT CHR$(4)"BRUN 

CP.OPTIONS" 
SAVE HELLO 

The disk is deprotccted. 

The remainder of this article shows a 
commented disassembly of CP.OPTIONS so 
you can become familiar with one type of nibble 
count program. 



Notes: 

1. When a RTS (Return from subroutine) 
instruction is executed the address stored on the 
stack has 1 added to it in order to obtain the 
true return address. So, when SC5FF is stored 
on the stack and a RTS occurs we will return 
to $C60O. 

2, The disk controller card is the one that 
actually reads the data from the disk. Location 
$C©8C is the output of the card. SCOSC is 
made zero and then the byte is read in a bit at 
a time starting with disk bit 7 which is initially 
placed in bit Oof $C08C. As each succeeding 
bit is read in the preceding bit(s) are shifted left 
one place and the new bit is placed in bit O. 
Since all disk bytes must have bit 7 = 1, it 
follows that when SCOSC shows bit 7 set the 
byte is complete. 

RWTS = $03D9 Vector address of RUTS 

GETIOB = I03E3 Get flWTS parm list address 

MTROFF = IC088 Drivemotor off 

MTRON = IC089 Drivemotor on 

STROBE = $C08C Minus when a byte is all in 



9000 20 E3 03 JSR GETIOB 




9003 85 FB STA $FB 


MSB parn l.st 


9005 84 FA STY tFA 


LSBparmUst 


9007 A9 C5 IDA rf$C5 


MSB of $C5FF to stack. See 


9009 48 PHA 


beiow for how IFF makes it 


900A A9 00 LDA SS00 


(nit" loop counter 


900C 35 FC STA $FC 




900E A2 03 LDX *$03 




9010 BC35 90 LOY 59035.X Set parml ist with zeroes 


9013 91 FA STA (JFA),Y at indices frcmtab.e. 


9015 CA DEX 


X = 3 . 2 . I 0,$FF 


9016 10 -3 BPL S9010 


Fall through when X = $FF 


9018 8A TXA 


$FFfromX-> A -> stack 


9019 48 PHA 


Stack now =SC5FF 


901/1 20 28 90 JSR S9028 


Seek to track zero 


901DA0 01 LDY4S01 




901F Bl FA LDA (SFA).Y Get s.ot*16 from 




parol ist 


9021 AA TAX 


Move slot *16 to X 


9022 20 39 90 jSR $9039 


Nibble away at it 


9025 68 PLA 


Remove $C5FF from stack 


9026 68 PLA 




9027 60 RTS 


Return sjecess 


9028 20E3 03 JSR GETIOB 




9028 20 D9 03 JSR RWTS 




902E A9 00 LDA J$00 




9030 85 48 STA $48 




9032 B0 52 BCS $9086 


Error on seek = panic time 


9034 60 RTS 





The following hex data table is used to get 
the drive head to Track zero. 

08 = LSB user's buffer 04 = Track 
0C = Command (seek) 03 = Vol. 

9035 08 04 0C HEX 08040C03 
9038 03 HEX 03 
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Here is where the nibble count begins. 

9039 BD 39 C0 LDA MTRON.X Motor (back) on 

903C A9 56 LDA «56 Loop counter for looking 
903E 85 FD STA JFD for $FB ' s 

9040 A9 03 LDA m& 

9042 C6FC DEC $FC $FF, IFF. ...0. $FF . . . . 

9044 D0 04 BNE H904A 

9046 C6FD DEC SFD $56. S55 : . . . 

9048 F0 3C BEQH9086 Exit failure 

When a disk is initialized it is with an 
address header of D5 AA96, a data header of D5 
MAD andadata block (96 96 96... )fullof zeros. 
This is repealed for 16 sectors. (ADZ ADZ 
ADZ ADZ... 16 times) 

The number of zeros is enough to reserve 
room for the future data. The nibble counts 
usually hide after the data before the next 
Address Header. We will be looking for the 
sequence of FB FF f i FF f f FF FF, Where the FF's 
are 10 bit bytes (001111 1111) and the f"fs are 
normal 8 bit bytes (1111 1111). The one shot 
read at S9057 will yield something less than 
S08 for 1© bit nibbles and something greater 
for 8 bit nibbles. (Hard to use Copy II Plus or 
Locksmith to scan for FB's followed by the 
above.) 

The number(s) in the comment fields give 
the cycles for that instruction. In the case of 
numbers like 2/3, the first is for fall through, 
the second is when the branch is taken. 

Each disk byte takes 32^s to read which 
is 4/iS per bit. Since the processor runs at lfts, 
32^15 is 32 machine cycles. Thus, each bit on 
the disk takes 4 machine cycles. 

For 8 bit bytes (ff) we have: 
^5 4444 4444= 32^s 
bits 1111 1111 

For 10 bit bytes (FF) wc have: 
M s44 4 4* 4 4 4444 = 40jis 

bits llll llll 

Ten bit bytes are also known as self synch 
bytes and are explained at great length in that 
ever popular tome, "'Beneath Apple DOS." 

The disk controller card starts reading a 
byte off the disk by first zeroing $C08C, then 
the next byte is shifted in from the right, a bit 
at a time, every 4/*s. Since it takes 16^s to20^s 
to go from S904A through S9057 it is ejear 
that Y is greater than $08 for 8 bit bytes: /IT 1 1 
(16) or 11111 (32). 

It follows that Y is less than $08 for 10 
bit bytes: 0011 (3) or 00111 (7). (Fast disk 
drives could mess this up) 

If the above is unclear then consider both 
the code below and the note ahove at length. 

904A BC8CC0 LDY STROBE X4 - ffa i i 'or ao;sk byte 

904D 10 FB BPL H904A 

904F C0FB CPV WFB 

9051 D0 ED BNE H9040 

9053 F0 00 BEQ H9055 

9055 EA NOP 

9056 EA NOP 



2/3 - B/not yet 

2 -Was ittFB 

2/3 - No/keep look.ig 

2/3- Yes XferS waste cycle 

2 -Waste a couple mo re 

2 



Note that the LDY STROBE,X below is 
NOT followed by a BPL This means we will 
take whatever has been seen by the disk 
controller card at this point. 

905? BC8CC0 LDY STROBE, X4 -Get part isliibble 
905AC0 0S CPV HM 2 -Set carry, fY>= 108 

"A" starts out as $08 & each time through 
is changed: 

03001000, 00010000, 00100000, 01000000. 10000000 

Last time through the carry is set & we go 
for final nibble. Note that "A" will (and is) 
something different if the carry was set. 

This is the real sequence: 

mum.miwm. 0015000;. mm®, 10000101, msm 

Init 1st 2nd 3rd 4th Last ROL 
FF ff FF f f A = $0A 

905C 2A ROL 2 

905DB00B BCSH906A 2/3 I f set , IcckforMal 

905F BC8CC0 LDY STROBE, X 4 

9062 10 FB BPL H905F 2/3 Wait partial to emp t 

9064C0FF CPYSIFF 2 Was it = $FF (or ff) 

9066 D0D8 BNEN9040 2 No Start over 

9068 F0EB BEQN9055 3 Always Xf er & Get 

partial 
906ABC8CC0 LDY STROBE. X Look 'or byte 
906D10FB BPL H906A 
906F 84 FC STY $FC $FF - t rusi ne 
9071 C90A CMPff$0A Was A = $SA from above? 
9073 D0CB BNE H9040 No, staM over 
9075 BD8CC0 LDA STROBE. X Another IFF -trust again 
9078 10 FB BPL H9075 

Misdirection. A = $FF and this just keeps 
it so. 

907A 38 SEC Gong to set LSB of A 

907B 2A ROL Keep A - JFF 

Think about things for a second: 

1 . The only value A can have before the 
EOR is $FF if it is going to be zero so the BNE 
doesn't take. 

2. A must - $FF before the AND and SFC 
must contain SFF since these are the only values 
that when ANDed together produce $FF. 

907C25FC ANDtFC $FF S SFF = S-FF 

907E49FF EOR WF IFF xor JFF = 100 
9080 D0 04 BNE H90S6 B/if wrong % die 
9082 DD88C0 fflP MTROFF.X Shut of disk drive 

9085 60 RTS Return Success 

9086 A8 TAY 

9087 DD88C0 MP MTROFF.X Off motor 

908A 68 PLA Pull return from JSHh9039 
908B 68 PLA of ; so *e return to IC60B 
908C 99 00 90 STA H9000.Y Wipethis rojtine 
908F C8 I NY 
9090 C0 8B CPV *S8B 
9092 D0F3 BNEH908C 
9094 60 RTS 



Phil Gostz 



If anyone would like to contact me, my 
BITNct address is PGOETZ@LOYVAX.bitnet 



Electronic Arts Protection Language 

I was boot-code tracing Amnesia, and I 
came to S370O. A protection routine starting 
at $3704 evidently checked for one sector of 
nothing but $AFs, but 1 didn't see where it was 
called. The tracing became very complicated 
and indirect, but I noticed that i kept circling 
back to $38C3. Then I realized that S38C3 was 
the equivalent of Applesoft's GETCHR for 
EOA's own interpretive language. After much 
tracing and disassembling, I decoded this 
language, which I call EOAPL. It is basically 
a small subset of 6502 machine language, and 
it is of course much slower, so its only purpose 
is to confuse crackers. 

To sec this code, boot Amnesia, When it 
asks you PLAY A SAVED GAME ? insert a 
normal disk into the drive and press I BESET I . 
All the code is left unaltered. 

In Amnesia, S3700 jumps to S376A: 

376A JSR 538E1 
3760 JSR J38B4 
3770 JMP $376A 

The "JSR $38B4" is the call to the 
interpreter, ft stores the address 3 bytes beyond 
the next instruction in the interpreter's program 
counter (in this case, S3773) and falls through 
to $38C3, which starts running the program at 
$3773. 

$38C3 is the crucial routine to look for: 

38C3 Bl 52 LDA (552; ,Y Get opcode 

38C5 C8 I NV Advance program counter 

38C6 D0 02 BNE S38CA 

38C8 E6 53 INC {53 

38CA AA TAX 

38CB BDD4 38 LDA $3804, X Get low byteof address 

wh en executes this 

instrjdion 

38CE 8DE0 39 S*A $39E0 Store it in the JMP 
38D1 4CDF39 JMP S39DF Execjte: rout i ne w. 1 1 
return via a JMP $3SC3 

39DF 4C n 39 JMP S39« 

Each instruction consists of a 1 -byte opcode 
followed by a 0, 1. or 2 byte parameter. 

The opcodes are not encoded. Each 1 byte 
parameter is EORed with $4C. Every 2 byte 
parameter is EORed with $D903 (the low byte 
is EORed with S03 and the high byte with 
SD9). 

EOAPL uses $56 as the accumulator and 
S53,52 as the program counter. $50-5E are 
used for various things. 
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The commands arc: 
Gp.LenA:d r Mnermon i cFunc t i on 



i 


3 


3900 GtTOadir 


i 


3 


3927 jSRV addr Call a machine Language 

sjbrout me «iih S56 as a value 

parameter; On entry A- 156, or 
exit $56 «- A. 


2 


3 


3955 GONE acdrGo to addr if $56> 


3 


2 


335F LD56 num 


i 


3 


396DLD56addr 


5 


3 


398A GSUB addr 


6 


3 


39AD ST56addr 


/ 


2 


39B9 S56- num 156- $56 -num 


8 


1 


39A2 9TRN Return from subroutine 


9 


3 


394F JSR addr Cal 1 amaenme language 
subroutine 


* 


3 


39CE iNC addr INCaddr :$56-(addr) 


e 


1 


3926 RTS Ek it programs return to machine 
language ca ; ler 


c 


3 


3979 S56- addr S56- $56+ (addr) 



So. for example, a routine to print "4C" 
would look like this: 

0300 20 E4 33 JSR $3SB4 

0303 60 RTS 

0304 00 BRK 

0305 00 BRK 

Disassembled EOAPL. 

0306 03 00 -. LD56ff$4C 
0308 91 D9 24 JSRVSFDDA 
030B 0B RTS 

About $BO bytes are in EOAPL - too many 
to disassemble by hand. So I rewrote the 
monitor disassembler (SF882-FA3F, enter at 
SF8DO) to disassemble EOAPL. Both the 
source and hex code is included here. The 
source is written for the Apple Toolkit 
Assembler. To enter the hex code, follow these 
steps: 

| 1 | Enter the monitor. 

CALL 151 



| 2 I Enter the EOAPL disassembler hex 
code. Remember: ihe numbers with the ""$" 
are checksums, you don't enter those. You 
compare them with the numbers you get from 
CHECKBIN to see if you made any errors. 

| 3 | Now save the binary code to disk, 
BSAVE EOADIS,A$8QO,L$112,V61 

There are three simple steps to use the 
KOAPL disassembler from the monitor. First, 
put the start address in $0 1 ,00. then put the 
number of lines to disassemble in $02 and. 
finally, type S0OG lo call the disassemble. 

So to disassemble the code in Amnesia at 
$3773, we type: 

0:73 37 13 
8000 

and we get: 
3773 04 62 EE LD56 $3761 



3776 07 74 S56- (S3S 

3778 02 SE El GONE S38SD Crash if $3761 ,s changed 

377B 04 61 EE LD56 $3762 

377E 07 2C S56- K60 

3780 02 BE El GONE J38SD Same for $3762 

3783 04 6BEE LD56 $3768 

3786 07 74 S55- JS38 

3788 02 8EE1 GONE $3880 Same for $3768 

378B 05ABEE GSUB I37A8 Ca 1 1 53704 S check for 

original 

378E 02 97EE GONE $3794 Fai I , try again 

3791 00A6EE GOTO I37A5 OK, ex.it 

3794 05 AB EE GSUB }37A8 

3797 02 9EEE GONE !379DFaM 

379A00A6EE GOTO $3 7A 5 OK, exit 

3790 07 4E S56- mi 

379F 02 SE El GONE I388D Crash if $56 wasn't 2 after 

$37A3 

37A2 0G70EE GOTO $3773 Do it again 

37A5 09A4E1 JSR $38A7 Exit to ca I ler 

Inspection of the disassembly shows us we 
can bypass the protection by switching the 
GONE $3794 at $378E with the GOTO $37A5 
at $3791 . That way it exits OK regardless of 
what happened, and any checksums are 
satisfied. Scanning the disk, we find 02 97 EE 
00 A6 EE on track $09, sector $02 at bytes 
$E2-E7. So to crack Amnesia, copy all tracks 
except track $06 and perform this sector edit 
on disk 1: 



PRNTBL 



.PRINT 



PMN 



PRADR1 
PRADR2 



Trk Set Byte(s) From 

$09 $02 $E^E4" 02 97EE 
$E5-E7 00A6EE 



To 



00 A6 EE 
02 97 EE 



EOAPL is also used in The Last Gladiator, 
Archon, Archonll: Adept, and probably many 
other EOA releases. 

EOAPL Disassembler Source 



PRADR3 



PRADR4 





ORG $300 


CODE 


EQU 2 


FORMAT EQU $2E 


LENGTH EQU $2F 




LDA 




STA $3A 




LDA 1 




STA $3B 




LDA 2 




STA 6 


LI 


JSR EOADIS 




LDA LENGTH 




SEC 




ADC $3A 




STA $3A 




BCC L2 




INC $3B 


L2 


DEC 6 




BNE LI 




RTS 


EOAOIS JSR INSDS1 


PRNTOP LDA {S3A),Y 




JSR $FDDA 



EQ903 
PR45 

PRADR5 



PRNTYX 



RTS 
ETAB 
LENTAB 
FMTTAB 



LDX *1 

JSR $F94A 
CPY LENGTH 
I NY 

BCC PRNTOP 
LDX « 
CPY U 
BCC PRNTBL 
MNEMONIC 
LDA CODE 
ASL A 
ASL A 
TAY 

LDX 34 
LDA MTAB.Y 
JSR IFDED 
I NY 
DEX 

BNE PMN 
JSR $F948 
LDY LENGTH 
LDX #6 
CPX #3 
BEQ PRADR5 
ASL FORMAT 
BCC PRADR3 
LDA $F9B3,X 
JSR IFDED 
LDA IF9B9.X 
BEQ PRADR3 
JSR $FDED 
DEX 

BNE PRADfil 
RTS 
DEY 

BMI PRADR2 
STX 3 

LDX LENGTH 
CPX n 
BCS ED903 
EOR «4C 
JMP PR45 
EOR ETAB.Y 
JSR $FDDA 
LDX 3 

LDA FORMAT 
CMP KSE8 
LDA (S3A),Y 
BCC PRADR4 
JSR $F9S6 
TAX 
I NX 

BNE PRNTYX 
I NY 
TYA 

JSR $FDDA 
TXA 

JMP $FDDA 
RTS 

DFB $3,$D9 

DFB 2,2,2.1,2,2.2,1.0,2,2.0,2.0 
DFB $80, $80,580. $20. $80, $80, $80, 
$20,0, $80, $80, 0.180,0 
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MTAB ASC /GOTOJ SR VGONELD56LD56GSUBST56 


S56-RTRNJSR INC RTS S56+77??/' 


INSDS1 LDX S3A 




LDY $3B 




JSR $FD96 




JSR JF948 




INSDS2 LDA ($3A,X) 




cmp no 


LEGAL OPCODE' 


BCC GETFMT 


YES 


LDA W 


717? 


GETFMT TAY 




STA CODE 




LDA LENTABj 




STA LENGTH 




LDA FMTTAB.Y 




STA FORMAT 




LDY S0 




RTS 





EOAPL Disassembler hex dump 



0800 


A5 00 85 3AA5 01 85 3B 


0808 


A9 16 85 06 20 IF 08 A5 


0810 


2F38 65 3A85 3A90 02 


0818 


E5 3B C6 06 D0 EE 60 20 


0820 


F0 08B13A20DAFDA2 


0828 


0120 4AF9C4 2FC8 90 


0830 


F1A2 03C0 04 90F2A5 


0838 


02 0A0AA8A2 04B9B8 


0840 


08 20EDFDC8CAD0F6 


0848 


20 48F9A4 2FA2 06E0 


0850 


03 F0 2E 06 2E 90 0E BD 


0858 


B3 F9 20 ED FD BD B9 F9 


0860 


F0 03 20EDFDCAD0E7 


0868 


60 88 30 E7 86 03 A6 2F 


0870 


E0 02 B0 05 49 4C 4C 7C 


0878 


08 59 9A 08 20 DA FD A6 


0880 


03A5 2EC9E8B1 3A 90 


0888 


E0 20 56F9AAE8D0 01 


0890 


C8 98 20 DA FD 8A 4C DA 


0898 


FD 60 03 D9 02 02 02 01 


08A0 


02 02 02 0100 02 02 00 


08A8 


02 00 80 80 80 20 80 80 


08B0 


80 20 00 80 80 00 80 00 


08B3 


C7 CF D4 CF CA D3 D2 D6 


08C0 


C7 CF CE C5 CC C4 B5 B6 


08C8 


CC C4 B5 66 C7 D3 D5 C2 


08D0 


D3 D4 B5 B6 D3 B5 B6 AD 


08D8 


D2 D4 D2 CE CA D3 D2 A0 


08E0 


C9 CE C3 A0 D2 D4 D3 A0 


08E8 


D3 B5 B6 AB BF BF BF BF 


08F0 


A6 3A A4 3B 20 96 FD 20 


08F8 


48F9A13AC9 0D90 02 


0900 


A9 0DA8 85 02B9 9C08 


0908 


85 2F B9 AA 08 85 2E A0 


0910 


00 60 



$6CBE 
I82F1 
I4FC9 
I78B4 
I7E59 
$55BF 
SDC50 
I734C 
SF831 
SC68C 

SEB14 
SA669 
$AF8B 
$6666 
$F1AC 
JFBBB 
$A9D0 
I07EE 
SDB2E 
$1283 

IAA8F 
$9B6F 
$AB0F 
J1FD2 
3A30E 
SC32C 
S9E0C 
$511A 
IF4D2 
$5048 

$A29A 
J3C80 
S72E1 
SFF0F 
SFD41 



Diskscan: 

How to find EOR on disk 



I was tired of getting a "HARDWARE 
FAILURE!" no matter what I tried with F-15 
Strike Eagle. I searched for the string on disk, 
but it wasn't there. Knowing Microprose 
encoded with a simple EOR, I wrote Diskscan 
to scan an entire disk for a string which had 
been EORed with any value. 

To use Diskscan: Enter the length of the 
pattern you want to find in $300, and the 
pattern from $301 on. Then BRUN SCAN. It 
will ask you if you want to SCAN (U)P OR 
(D)OWN? If you choose D (which is usually 
the best choice), Diskscan will scan the disk 
from traek $22, scetor $OF down to track $00, 
sector $00. More importantly, if it sees the 
beginning of the string on traek $1A, sector 
$07, it will look for the rest of it on track $1A, 
sector S06. If you were scanning up, it would 
look for the rest on track S1A. sector $08. 

Every time it finds a match, it will print 
the track, sector, byte#of the start of the match. 
and the value which the pattern was EORed 
with. You may press ESC at any time to halt it. 

So to search for HARDWARE I enter: 

CALL -151 

300:8 CS CI D2 C4 07 CI D2 CS 

BRUN SCAN 

D for read down 

If you tried this on the original, you would 
get: 

T$22S$0F ERROR W0 
TJ22 SS0E ERROR M40 

and so on. But since I am using a normal- 
format copy, after a few minutes Diskscan 
responds with: 



DISKSCAN source code 



. L I F 



LOCATE EOR-ENCODED STRING 



T$17SS0F65:C0 
T$00 SS00 
* 



you're still in the monitor 



This means that C8 01 D2 C4 D7 CI D2 C5 
EORed with $C0 is on track $17, sector $0F 
starting at byte $65. 

Note that Applesoft must be resident, 
because Diskscan calls $DB3A to print. Also, 
if your DOS is non-standard or in an unusual 
location, you should replace the JMP SA851 
with JMP $3D0. $3D0 will both reconnect 
DOS and enter BASIC. 

Diskscan is written using the S-C Macro 
Assembler. "/LABEL" means the high-byte of 
LABEL, "#LABEL" is the low-byte. ".BSn" 
creates n zeroes. Enter the hex dump and save 
it as "DISKSCAN, A$2222, L$1D2'. 





.OR S2222 






.TF SCAN 




SCAN 


JSR $FE89 
JSR $FE93 
LDY /UOD 
LDA ffUOD 
JSR IDB3A 
LDA JC010 


derail DOS 


.10 


LDA JC000 
BPL .10 

cmp H 

BEQ UP 
CMP f.ti 
BEQ UP 




DOWN 


LDY *S23 


t rack 




LDX S0 


sector 




LDA #$FF 


me 




BNE SETUP 




UP 


LOY SSFF 


track 




LOX «$F 


sector 




LDA #1 


irtc 


SETUP 


STY TRACK 
STX SECT 
STA INC 






LDA #0 






STA VOL 






STA PTR 






LDA HI 






STA CMND 






STA FLAG tell 


gefbyte to read sector 




JSR SFD8E 






JSR PTS 




GO 


LDX #0 
STX MIND 
LDA LEN 
STA LEN2 
LDA PTR 
STA MSTART 
LDA TRACK 
STA T0 
LDA SECT 
STA S0 




.10 


JSR GETBYTE 

BCS .90 

LDX MIND 

BNE .20 

PHA 

EOR STRING 

STA EOR 

PLA 




.20 


EOR STRING.X 
CMP EOR 






BNE ,30 


no match 




INC MIND 






DEC LEN2 


matched this char 




BNE .10 




* . . . . 




Complete match 




LDA T0 






JSR PT 
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LDA S0 
JSR PS 

LDA #10 
STA (24 
LDA MSTART 
JSR $FDDA 
LDA f : 
JSR $FDF0 
LDA EOR 
JSR SFDDA 
JSR PTS 
LDA TRACK 
JSR PT 
LDA SECT 
JSR PS 

* Go back 8 start at byte after beginning of 
last natch attempt, see if we need to go back a 
sector. 



.30 


LDV MSTART 
INY 






BEQ .40 OK if getbytewill read in 




CPV PTR 


iew sector 




BCC ,40 


OK i f MSTART<PTR 




LDA PTR 






BEQ 40 


OK if next sector hasn't 
been read 




LDA T0 






STA TRACK 






LOA S0 






STA SECT 






JSR RWTS 






LDV MSTART 






INY 




.40 


STY PTR 
JMP GO 




.90 


LDA SC010 






JSR $FE84 


1 don't know why, but my 
Appiegoes bad if these 




JSR $FB2F 


aren't both called 




JMP $A851 


connect DOS 


PTS 


LDY /TS 

LDA #TS 
JSR $DB3A 
LDA $25 
STA VTAB 

RTS 




PT 


LDX #2 
.HS 2C 




PS 


LDX #7 
STX $24 

JMP $FDDA 




GETBYTE .,;'' XWi. 






CMP #$A0 






BEQ GETBYTE 


pause 




CMP #$9B 


Esc exits 




BEQ .20 






LDY PTR 






BNE .0 






LDA MSTART 


If MSTART=PTR=0, 

already loaded sector 
during last comparison 




ORA FLAG 


load if 1st sector read 




BNE .1 


new sector 



,0 


LDA BUFFER, Y 






MSTART .BS 1 match star 


t index 




INC PTR 






PTR .HS 00 pointer i nto buffer 




CLC 






T0 .BS 1 track match started on 




RTS 






S0 .BS 1 




.1 


LDA VTAB 
STA $25 






VTAB .BS 1 
* 






JSR $FC22 




Vtab 


IOB .HS 016001 






LDY m 






VOL .HS 00 






STY FLAG 






TRACK .BS 1 






LDA SECT 






SECT .BS 1 






CLC 






.DA DEVTAB 






ADC INC 






BUF .DA SUFFER 






BPL .3 






.HS 0000 






LOA #SF 






CMND .BS 1 






INY 


flag new 


track 


ERR .HS 00 




. 3 


CMP #$10 






.HS FE6001 






BNE .4 
LDA m 






DEVTAB ,HS 0001EFD8 

BUFFER 






INY 


new 


track 


* 




.4 


STA SECT 
TYA 






.OR $300 
LEN ,BS 1 






BEQ .5 


no new track 


STRING 






LDA TRACK 
CLC 

ADC INC 
BMI .20 




done 








DISKSCAN hex dump 












CMP #$23 




done 


2222: 20 89FE20 93FE 


$6976 




BEQ .20 




2228: A0 23A9AB20 3ADBAD 


$DF75 




STA TRACK 






2230: 10C0AD00C010FBC9 


$914B 




JSR PT 






2238:D5F0 0CC9F5F0 08A0 


$7E77 


1 


LDA SECT 






2240: 23 A2 00 A9 FF 00 06 A0 


$7638 




JSR PS 






2248: FFA2 0FA9 018CE3 23 


$DD76 




JSR RWTS 






2250: 8EE4 23 8DO7 23A9 00 


I74C6 




LDY #0 






2258: 8DE2 23 8DDB23A9 01 


$23E4 




BCC .0 






2260: 8D EB 23 8D D6 23 20 8E 


$3A7B 




LDY /ERRMSG 
LDA SERRMSG 
JSR $DB3A 






2268: FD 20 10 23 A2 00 8E 09 


$1C7D 








2270: 23 AD 00 03 8DD8 23 AD 


$5729 




LDA ERR 






2278: DB23 8DDA23ADE3 23 


S59E8 




JSR $FDDA 






2280: 8D DC 23 AD E4 23 3D OD 


S23E2 




JSR PTS 






2288: 23 20 27 23 B0 76 AE D9 


$76C8 




JMP 1 






2290: 23D0 08 48 4D0103 8D 


$827F 


,10 


CLC 
RTS 






2298: D5 23 68 5D 01 03 CD D5 


$684E 






22A0: 23 00 38 EE D9 23 CE D8 


$41E4 


.20 








22A8: 23 D0 DE AD DC 23 20 ID 


$004C 


done 






22B0: 23 AD DD 23 20 20 23 A9 


$852A 




RTS 






22B8:0A85 24ADDA23 20DA 


$14BA 


RWTS 


LDA /I OB 






22C0: FD A9 BA 20 F0 FD AD D5 


$4234 




LDY #IOB 






22C8: 23 20 DA FD 20 10 23 AD 


$1D7C 




JMP $309 






22D0: E3 23 20 ID 23 AD E4 23 


$4504 


uoo 


.HS 8D 






22D8: 20 20 23 AC DA 23 C8 F0 


$CA22 




.AS -/READ(U)POR(D)OWN?/ 




22E0: 1DCC DB 23 90 18 AD DB 


$93CB 




.HS 00 






22E8: 23 F0 13 AD DC 23 SD E3 


$A488 


TS 


,HS 8D 






22F0: 23 AD DO 23 8DE4 23 20 


$9EB5 




.AS -/T$S$/ 






22F8: A4 23 AC DA 23 C8 8C OB 


$793B 




HS 00 






2300: 23 4C 6C 22 AD 10 C0 20 


$DA78 


ERRMSG 


.AS -/ ERR#$/ 3 spaces befo 


re err 


2308: 84FE20 2FFB4C51 A8 


S10F2 


EOR 


.HS 00 

,BS i byte which 

on disk 

DC 1 


string is EORedwith 


2310: A0 23 A9 C2 20 3A DB A5 
2318: 25 8D DE 23 60 A2 02 2C 


S8399 
S89EE 


FLAG 
INC 
LEN2 
MINO 






2320: A2 07 86 24 4C DA FD AD 


JC181 


.DO 1 

.BS 1 T/S increment: move upor down 
.BS 1 countdown tomatch 
.BS 1 match index 


2328:00C0C9A0F0F9C9 9B 
2330: F0 70 AC DB 23 00 08 AD 
2338: DA 23 0D D6 23 00 08 B9 
2340: F4 23EEDB23 18 60AD 


$27B6 
$0218 
$5CC4 

$CF6F 
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2348:DE23 85 25 20 22FCA0 
2350: 00 8C D6 23 AD E4 23 IB 

2358: 6DD7 2310 03A9 0FC8 



2360 


C910D0 03A9 00C8 8D 


2368 


E4 23 98F013ADE3 23 


2370 


18 6DD7 23 30 2CC9 23 


2378 


F0 28 3D E3 23 20 ID 23 


2380 


AD E4 23 20 20 23 20 A4 


2388 


23 A0 00 90 B2 A0 23 A9 


2390 


CB 20 3A DB AD EC 23 20 


2398. 


DA FD 20 10 23 4C 47 23 


23A0: 


18 60 38 60A9 23A0DF 


23A8: 


4C D9 03 8D D2 C5 CI C4 


23B0: 


A0 A8 D5 A9 D0 A0 CF D2 


23B8: 


A0 A8 C4 A9 CF D7 CE BF 


23C0: 


A0 00 8D D4 A4 A0 A0 A0 


23C8: 


D3 A4 00 A0 A0 A0 C5 D2 


23D0: 


D2 A0 A3 A4 00 00 00 00 


23D8: 


00 00 00 00 00 00 00 01 


23E0: 


60 01 00 00 00 F0 23 F4 


23E8: 


23 00 00 00 00 FE 60 01 


23F0: 


00 01 EF D8 



$BEE6 
$667B 
I063C 

$A8C3 
?43E3 
$1DDF 
S7C1E 
JE01F 
$E2E9 
$744B 
$EB6A 
SE58F 
SA6B3 

$206C 
$1519 

$CF02 
SCC2D 
$F2C0 
$53C0 
SA1A3 
JB9E1 
?B12C 



Jose A. Mont ano 



Raves for the Macintosh Extended 
Keyboard 

I have just purchased Apple's new 
Macintosh extended keyboard and attached it 
to my GS to see what would happen. Lo and 
behold! Nothing happened (nothing wrong, that 
is). It works great on the GS. The key action 
is much smoother and you have 21 extra keys 
to assign whatever functions you want. In 
addition, the CONTROL, OPTION and 
APPLE keys are duplicated on the lower right 
hand side where the GS arrow keys are. The 
arrow keys are to the right of these (in a more 
sensible layout, if I do say so myself). 

For any of your readers who are interested 
in using the new keyboard, here are a few things 
I have found out about it. 

Extra Keys and Their ASCII Values 

Fl z ChrJ(122) F12 o ChrJ(lll) 

F2 x ChrJ(120) F13 i Cbr$(105) 

F3 c Chr$<99) F14 k Chr*(107) 

F4 v Chr$(118) F15 q Chr$(113) 

F5 ' CM(96) HELP r Chr$(114) 

F6 a CM(97) Del u Chr$(117) 

F7 b Chr$(98) HOME s Chr$(115) 

F8 d Chr$(100) END w ChrJ(119) 

F9 e ChrS(101) PAGEUP t Chr$(116) 

F10 mChr$(109) PAGE DOWN y Chr$(121) 

Fll g Chr$(103) 

All extra keys set Bit 4 in the KEYMOD 
Register at location $C025 (49189) indicating 
they were pressed on the numeric keypad. 

For most BASIC applications there is no 
difference between Fl and "z", for example. 



To see the difference you must query the 
KEYMOD Register with suitable assembler 
instructions such as: 

LOOP LDA $C025 Get the current key status 
BIT #$10 fas key pressed on keypad? 
BEQ LOOP If not, recheck key status 
LDA SC000 If so, load key Into 

Accumulator 
STA SC010 Clear the keyboard strobe 

continue with your code 

One possible Applesoft BASIC 
differentiation would be: 

100 GET A$ 

110 KM = PEEK(49189) 

120 IFKHo 16 THEN PRINT CHR$(13) : GOTO 100 

130 PRINT A$ 

.. .continue with your code 

For the sake of interest, the following chart 
shows how the KEYMOD register is 
bit-mapped. 

BIT VAL DESCRIPTION 

7 1 If GJ] was pressed 

6 1 If Opt ion key was pressed (CE) 
5 1 If the modifier key latch has data 
(any key pressed) 

4 1 I f a key on the numer i c keypad has 

been pressed 
3 1 If a key has been held down long 

enough to engage repeat 
2 1 If the Caps Lock key is down 
1 1 If the Shi ft key is down 
Unknown (or Unused) 

This keyboard could add whole new 
dimensions to commercial applications if 
software designers for the Ilgs would program 
with the new keyboard in mind. You could also 
enhance your own personal masterpieces by 
using the function keys for program flow 
instead of the cryptic keypresses that must be 
used now. The new keyboard also allows for 
function key overlays to let you label each 
function key the way you want to. 

Apple's new extended keyboard is a boon 
not only for Macintosh users, but for Apple Ilgs 
users , as well , and the sooner software 
companies realize it the better. 



Jolly Roger of The Curse 



Soflkey for.. 



Microzine #14 Fun House 

Scholastic 



■ Requirements 

□ Sector editor 

When asked to deprotect this software I 
first consulted old issues of COMPUTIST and 
found it was not listed. It was listed in the Copy 



IlPius parameter list, but a copy made with this 
program (or any bit copier) wouldn't work. 
Having exhausted the "easy" methods, it was 
time to do an original crack. 

Too many softkeys give only the slep-by- 
step procedures and not how the crack was 
done. Fear not - details follow! 

The first step is to determine the type of 
protection. Was an altered DOS or a nibble 
count used or were other nefarious and sneaky 
tricks employed? 

Upon boot, an Applesoft prompt appeared 
which would mean DOS is reasonably intact. 
The disk could be cataloged under normal DOS 
3,3 - normal DOS may be used. The disk could 
be copied with COPY A, but the copy 
continually reboots. This leads us to a nibble 
count or some sort of disk signature checking 
routine as the major protection. 

Copy II Plus revealed that the boot program 
was named HELLO. This was beginning to 
look loo easy, Hmmmm, when DOS 3.3 is 
booted and then the HELLO program loaded 
the only thing that appeared with the LIST 
command is REM. 

After a CALL- 151 to enter the monitor, a 
check of $0067 shows that the listing should 
begin at $0801 - all normal. However, looking 
at the code beginning at $080 1 shows that the 
authors have screwed around with the BASIC 
line pointers to prevent us from LISTing the 
HELLO program and thus discovering the file 
that is called which contains the CALL to the 
protection code. 

Well, it would have been a simple, but 
perhaps tedious, task to un-diddle the line 
pointers but an easier way around this was 
possible. I simply invoked MONICO and then 
ran the HELLO program. The first file loaded 
was W.SPC, a suspiciously short binary file. 
I went back to Copy II Plus and mapped the 
disk to find the location of the offending W.SPC 
file. It was located on track $05, sectors $02 
and $01, Another way to do this would have 
been to go to track $11 (catalog) and read the 
location from there, but I'm lazy. 

Anyway, using the sector editor, I went to 
track $05, sector $02 and found the 
Track/Sector list for the file which just said that 
the file was located on sector $01. Since this 
was a binary file, the first two bytes at the 
beginning of track $01 were the start address 
of the file in memory and the next two were 
the file length. The actual code began at byte 
5 aand was a JSR to wherever. I didn't even 
look. The code was a series of stack pushes and 
pulls - pretty obvious this was protection code. 
I just slapped an 18 60 into bytes 5 and 6 and 
booted the disk. It worked fine. They didn't 
even bother to checksum the protection code 
to see if it was changed. Of course, you could 
un-diddle the HELLO program and remove the 
BASIC CALL to the start address of the W.SPC 
file but that's too much work. 
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Step-By-Step 



| 1 | Copy the disk with COPYA or any 
disk copy program. 



I Z I Make the following sector edit: 

Trk Set Byte(s) From To 

$05 $01 $05-06 20 XX 



18 60 



John Wulfken 



Softkey for. 



Hardball II gs 

Accolade 



■ Requirements 

□ Apple Ilgs with 512K 

□ A blank 5W" disk 

□ A sector editor like Copy II Plus 

I found a simple approach to deprotecting 
HardBail GS by first removing all references 
to the reset vector, and loading in all values 
changed by the protection. The protection itself 
starts at hex address $2C00 with two calls to 
hex address $6B5D. If you would like to trace 
the protection, I recommend that you purchase 
a copy of Apple Ilgs Firmware Reference the 
official publication. Chapter 7 contains a wealth 
of information on deprotecting GS software. 

The code at $6B5D is a nice piece of work 
by Accolade. It loads in as a JSR FFFF and is 
changed during program execution to a JSR 
C5GD. This is a smartport call much like the 
ProDOS call JSR BF0O call. 

Step-By-Step 



I 1 | Make a copy of your original disk. 
Then format a 5 VI" disk. Move the file 
HARDBALL/SYSTEM/START from your 
copy disk to your 5VS" disk, 

| 2 I Using a sector editor search for 8F F3 
03 00 and replace with EA EA EA EA. 

I 3 | Copy this file back to your disk and 
reformat your 5W" disk. Copy the file 
HARDBALL/HARD.CODE to your 5 U " disk 
and search for 9C F3 03 9C F4 03 and replace with 
EA EA EA E A EA EA. You will now be able to 
iGHESETl and the disk will not reboot. 



r~4~l Search for 0881 
20 AD ? and replace with 
1E8D79 03A9D0 8D3B00 
F4 00 A9 B0 8D F6 00 A9 0D 
8DEC00A919 8DEA00A9 
00A9 03 8D02 95A9F8 8D 
41 80 06 95 8D0A95 A9 52 
A9 42 8D09 95A9 4C8D0B 
00 8DF100 8DEE00 8D00 
0D95 8D0E95A2E3A0 IF 



30BC2 20A9 5D 
38 28 A9 35 8D 
A912 8DF0 00 
8D F7 00 A9 22 
0B 8D EB 00 A9 
04 95 A9 48 8D 
3D 07 95 A9 44 
958D 0C 95 A9 
95 8D 01 95 80 
60 EA EA EA 



6A5BE2 
78 03 A9 
A9 01 8D 
8D F8 00 
A8 8D ED 
05 95 A9 
8D08 95 
00 3D F5 
03 95 3D 



I 5 I Now copy the file back to your 3 'A " 
disk and that is it. 

Winter Games GS also uses the same type 
of protection. 



Doug Parrish j 


Softkey for... 


Typewriter 

Channelmark 



■ Requirements 

□ Typewriter original 

D 1 blank disk side 

D Sector editor (Copy II Plus is fine) 

Jim Hart, COMPUTIST #52, page 23, did 
the work on Grid Designer and I applied it to 
another one of Channelmark's disks. 

A friend badly needed Typewriter backed 
up, so he gave it to me. Channelmark had 
always caused me trouble, but Jim Hart's crack 
for Grid Designer suddenly gave me new hope. 

Before I go further, I'd like to pass on a 
tip I have picked up while working with 
deprotecting schemes. There is definitely a 
difference between a "blank" disk and one 
you're going to reuse. Blanks have no leftover 
code from a previous program, while "used" 
disks do. Although I don't know the ins and outs 
of disk code deleting that well, I suspect that 
the code left on a disk can cause deliberate 
misreads when the copy procedure is trying to 
lay down accurate timing and epilog bytes. 

2E Unless special hardware was used to 
record an extra strong pattern an a disk, 
initializing will erase whatever was on a disk 
by writing new patterns. However, deleting all 
the files on a disk does not remove the data from 
that disk. It only deletes part of the pointer to 
that data so that the catalog command will show 
no files. If you need a blank, unformatted disk, 
use a bulk tape eraser RDEXed 



| 1 | Use Copy H Plus to copy the program 
side of Typewriter to the blank disk, 

I 2 I Using the sector editor, make the 
following two changes to the code on the copy: 

Trk Set Byte(s) From To 



$11 m S3E-40 
$1E $0C $3E-40 



AD E9 C0 
AD E9 C0 



18 90 4C 
18 90 4C 



One other Item 

Cj^) On Three puts out a program 
called Graphics Manager. It reduces and 
enlarges clip art and allows it to be placed 
anywhere on a page, or so the flyer says. Over 
the past year and a half, I have tried to get the 



program to work with my setup: Apple He 
(unenhanced), RamWorks D with I meg, 2 Disk 
U's and a parallel Okidata 92 printer. I even 
photocopied the parallel Grappler Plus manual 
and sent it to them in hopes they could rewrite 
the code. They tried. So far, nothing. I finally 
gave up and I guess they did too after the third 
or fourth disk got here. 

Can anybody explain to me why this won't 
work, what I have to do, what code I could 
change? They say it's the parallel interface. But 
the Grappler Plus works just fine on everything 
else, except their disk. Do I have to reset the 
DIP switches under the printer's housing? Has 
anyone out there solved this one yet? 

Keep up the fantastic format! It's superb. 
COMPUTIST has helped me so many times, 
it has more than paid for the subscription price. 



Keith Parker 



Softkey for.. 



Bard's Tale II 

Electronic Arts 



■ Requirements 

□ A blank disk 
D A sector editor 

□ Copy program that will ignore errors 

(Locksmith 's Fast Backup) 

□ Bard's Tale II: Destiny Knight original 

When I heard about the release of Bard's 
Tale II, I couldn't believe it would have better 
graphics than Bard's Tale. I told all of my 
friends, "Different graphics maybe, but better 
ones? No way! " . I was definitely wrong! Bard's 
Tale II does have better graphics. Bard's Tale 
II also has new magic spells, more towns, 
dungeons, and monsters. 

The protection used on this game is very 
similar to the protection used on Boulderdash. 
It seems that Electronic Arts is starting to repeat 
their protection schemes. 

To start off, I copied the disk with 
Locksmith 's Fast Backup. This told me that 
track $06 was the error track. I then booted 
up my copy to see how far it would get. After 
the EA logo came up the program did it's first 
check. I jumped into the monitor using Senior 
Prom and looked at SA000. 1 wrote down the 
first 3 bytes and then searched my disk for the 
sequence, I found it on track $01, sector $0F 
starting at byte $00. 1 changed the jump code 
by putting a 60 in place of the 46. Now I had to 
correct the checksum by changing byte $FF of 
track $10, sector $07 from 0F to 02. 

I then booted up my disk. The program 
started to load exactly like the original, until 
it tried to load in the player screen (the main 
part of the game). The grinding noise, that came 



July 



COMPUTIST #57 



15 



from my drive, was enough to give anybody 
a heart attack. I jumped into the monitor using 
Senior Prom to see what was going on. Hooked 
at the softkey for Boulderdash again. In that 
softkey, the protection code started with the byte 
sequence A9 14 48. I used the Search Memory 
function with the Senior Prom to scan for the 
sequence. No luck. So I decided to scan for the 
byte sequence A9 = 48 (The " = " is a wildcard, 
meaning any byte can be there.). The Senior 
Prom found the sequence in four locations. 
Since one of the locations was in my computers 
ROM, that eliminated that choice. I listed the 
other three locations and found that two of them 
were identical. EA is known for making such 
routines. Here is what the routine looks like: 

2E44 A9 00 LDA #$00 

2E46 48 PHA 

2E47 A5 44 LDA $44 

2E49 D9A4B3 CMP $B3A4,Y 

2E4C 90 12 BCC I2E60 

2E4E F9A4 83 SBC $B3A4,V 

2E51 85 44 STA $44 

2E53 A5 45 LDA $45 

2E55 E9 00 SBC #$00 

2E57 85 45 STA $45 

2E59 68 PLA 

2E5A 69 00 ADC #$00 

2E5C 48 PHA 

2E5D 4C47AE JMP $AE47 

2E60 68 PLA 

2E61 09 B0 ORA #$B0 

2E63 20EDFD JSR $FDED 

2E56 88 DEV 

2E67 10 DB BPL S2E44 

2E69 60 RTS 

The same routine was found at location 
$3144. I then pulled out my sector editor and 
searched for the byte sequence A9 00 48. 1 found 
it at track $0F, sector $01 and track $10, 
sector $0E. I replaced the jump with 18 60 40 
and then booted up the copy. It worked like a 
charm! 

I 1 I Copy the disk with a copier that will 
ignore errors. 

I 2 I Boot up your sector editor and make 
the following changes (Be sure to write the 
sectors back to disk.): 



Greg Poulos 



Trk Set Byte(s) 


From 
0F 


To 


$01 $07 $FF 


02 


$0F $00 


4C 


60 


$0F $01 $44 


A9 00 48 


18 60 40 


$10 $0E $44 


A9 00 48 


18 60 40 



Go out and destroy the evil Archmage 
Lagoth Zanta. 



How To Modify All Infocom Games 
For Lower-case 

Many years ago, there was a fde floating 
around that explained how to modify Infocom 
games to produce lower case characters during 
game play. The procedure outlined in that file 
worked beautifully on Infocom 's first releases. 
But, alas, times changed and Infocom 
moved things around on the disk. In the newer 
versions on their games, you are able to select 
40 or 80 column output. Anyone who has tried 
the well-known old techniques to get lower-case 
has probably come up with zero success. 

Well, I did some searching around and 
found that although the location of the code may 
have jumped around a bit, the code that changes 
the output is the exact same on all Infocom 
games. 

The reason Infocom makes all the 40 
column output upper-case, is because they think 
there are still people that have no lower-case 
chip in their Apple. Somebody ought to tell 
them that 99% of Apple owners have 
lower-case. 

There are three chunks of code that must 
be altered to create a nice looking lower-case 
output. The first routine prints the ever-familiar 
inverse bar at the top of the screen. This 
contains your location and either your 
score/number of moves or the time. This 
routine must be altered to not print in inverse, 
for as we all know, inverse lower-case 
characters don't agree with the Apple, although 
in 80 columns you get inverse/lower-case. This 
is the only thing you'll lose if you decide to 
modify your Infocom games to lower-case, 
there'll be no pretty inverse bar, not even in 
80 columns. 

The next routine is a big one. This is the 
routine that actually converts all the characters 
to upper case. This is eleven bytes long 
(decimal) and will have to be completely 
NOPed out with eleven EA's. 

The final routine determines the size of the 
window at the top of the screen for the text to 
scroll under. This is currently one line (the 
inverse bar). For easier readability, you'll want 
to change this to two lines, so there's a blank 
line in between the location description, score, 
etc., and the actual game text itself. 

So with all the explanation out of the way, 
let's go to work. You must first have a cracked 
copy of the game. Nowadays, Infocom only 
protects their two-sided, 128K games like 
Trinity, but in case you have an old Zork or 
something, deprotect it first. (See Book of 
Softkeys Vol. 1 forZwAr). 



Run a sector editor like the one in Copy 
II Pius that has search capability. Insert your 
Infocom disk. 

The Inverse Routine 

Search for hex bytes A9 3F 85 32 A9 10. Once 
you find these (somewhere on the first two or 
three tracks, probably), change the 3F to FF. 

The Window Routine 

Search for hex bytes A9 01 85 22 85 E0. Once 
you find these, change the 01 to an 02. Note: 02 
is recommended. You may change this to a 
higher number to get a wider gap. NOTE: If 
you cannot find the "Window' ' routine, search 
for A9 01 85 22 instead. 

The Upper Case Routine 

Search for hex bytes C9 60 90 0B C9 80 B0 07. 
Once these are found, put the cursor on the first 
byte (the first C9) and enter eleven EA's. 

That's all there is to it. Something you 
might try doing is allowing the inverse bar in 
80 columns, but making it normal in 40 
columns. I haven't been able to do this as of yet. 



David Burns and Brian Sparks 



Softkey for. . . 



California Games 
Championship Wrestling 
The Movie Monster Game 

Epyx 



■ Requirements 

□ A blank DOS 3.3 formatted disk (double 

sided) 

□ Fast copier (that ignores errors) 

□ A sector editor (I used Copy II plus) 

California Games is a really rad game from 
Epyx that enhances the Summer games line. 
After about an hour of playing, you will start 
using words like gnarly, tubular, and awesome 
as part of your everyday vocabulary. Just follow 
these instructions for a deprotected copy: 

I 1 I Fast copy both sides of California 
Games with any fast copier that ignores errors. 

I 2 [ Make the following sector edits: 

Trk Set Byte(s) From 
$00 $05 $F0-F7 00 00~00~i 



To 



$5E-60 

I6E-70 



00 00 00 

BD 8C C0 
BD 8C C0 



FC EE EE FC E7 
EE FC E7 

AD Fl BB 

B9 F0 BB 
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I 3 | Write these changes back to disk. 
Side 2 is not protected. This softkey also 
works with two other Epyx games I recently 
bought, Championship Wrestling and The 
Movie Monster Game. 



Robert Wilson 



Softkey for.. 



Deep Space 

Sir-Tech 



■ Requirements 

□ Apple II series with 64K 

□ COPYA 

□ Sector editor 
Q Blank disk 

Deep Space is a space-combat simulator 
that features smooth, convincing 3-D graphics 
as you fly four different missions in an area of 
the astroid belt that lies between the orbits of 
Mars and Jupiter. 

The disk is virtually unprotected and can 
be copied with any copier that will ignore the 
read error on track $22. The resulting copy will 
not work however, even though track $22 
contains no useful code. To make a long search 
short, a little detective work led me to the entry 
point for the protection routine. I found it on 
track $OC, sector $09. 

Step by step 

I 1 | Boot your DOS 3.3 system disk. 



I 2 | Tell DOS to ignore checksum and 
epilog errors and use COPYA to copy the disk. 
POKE 47426,24 
RUN COPTA 



3 | Make the following sector edits to the 



copy you just made. 

Trk Set Byte(s) From 
$0C $09 $8B-8C A90D 



To 



18 60 



That's it. The copy should now work and 
is COPYA-able. 

A.P.T. for... 



Deep Space 

Sir-Tech 



Now here are some A.P.T.s that may make 
your new copy of Deep Space a bit more 
interesting. 

Unlimited fuel: 



Trk Set Byte{s) From 



$1B $0E SE2-E3 C6 4F 



To 



EAEA 



Unlimited hyperspace drive: 

Trk Set Byte(s) From To 

$21 $08 $E7-E8 E5 03 



38 EA 



Unlimited missiles: 

Trk Sot Byte(s) From 



To 



$1C $02 $66-67 F0 28 

$BD-BF CE8F60 



EAEA 
EA EA EA 



To stop those irritating attacks on your 
bases while flying the Outpost Mission: 

Trk Set Byte(s) From To 



$21 $04 $8C-8D C6 55 



EAEA 



An indestructable shield is available by 
changing the following: 

Trk Set Byte(s) From To 



$1C $01 $EE-FF E5 10 



EAEA 



Also, a dot of transparent tape punched out 
with a hole punch while the tape is still stretched 
out on the despenser, then placed at the right 
spot on the screen, makes an excellent gun sight 
for the missiles and laser. 

A co-author of Deep Space, has an 
excellent new flight simulator in the stores. It 
is being sold as Chuck Yeager's Advanced 
Flight Trainer, this one can teach you to master 
other flight simulators, and allows you to fly 
14 different airplanes ranging from the Sopwith 
Camel F-l to experimental rocket planes that 
can take you to the edge of space. 

While Advanced Flight Trainer is published 
by Electronic Arts, it contains none of their well 
published locks. Headers that change with every 
sector, and a few other goodies too, it looks like 
a challenge for the advanced hacker. 

How about it, ladies and gentlemen, is there 
anyone out there who can crack this one? 



Softkey for. 



Arcticfox 

Electronic Arts 



A friend of mine asked me to try and crack 
his original of Arcticfox before it goes 
"kaputt". I tried several of the softkeys from 
COMPUTIST, but none were able to crack it. 

Knowing that Electronic Arts uses their 
nibble check routine on track $01 , and that this 
basic type of protection is used on most EA 
games, I looked at the softkey for The Bard's 
Tale in COMPUTIST #51 to find some 
similarities. 

As I expected, some of the bytes were the 
same as in the Bard's Tale softkey, so I changed 
them to the values following them and it 
worked. Here's how it goes: 



Trk Set Byte(s) From 



$01 



To 



$47-49 


20 n ?? 


18 60 42 


$47-49 


20 F8 A0 


18 60 40 


$4C-4E 


20 03 A0 


18 60 4B 


$00-02 


4C69A0 


18 60 DD 


$6F-71 


4C 69 A0 


18 60 DD 



Playing Tips for.. 



Arcticfox 



Here is something that may be useful to 
new ArcticFox gamesters, unless you know 
about this already. Ever notice the two little 
boxes with the numbers in them on the lower- 
right of the screen? Those are for Latitude and 
Longitude. The main fortress lies around the 
following numbers (in order, top to bottom on 
the screen): 

053 06 

83 01 

From there you should be able to see the 
main fortress, and destroy it with a missile. Be 
careful, the alien base is highly fortified all 
around. Also DO NOT get too close to the 
fortress or else it will deploy homing mines 
(similar to floating mines, but bigger and more 
ominous) that will come out in waves and 
destroy you. The fortress has a limitless supply 
of these, so be wary. 



Jim S. Hart 



Softkey for., 



BouIderDasb Construction Set 

Epyx 



■ Requirements 

□ Boulder Dash Construction Set (BDCS) 

□ An initialized DOS 3.3 disk 
D COPYA 

□ Disk searcher/ sector editor (I used Copy II 

Plus) 
D Nibble editor 

□ Disk scanner Qikc Locksmith's, Quick Disk 

Scan, used for determining format of disk) 

□ Optional Recommended reading: Beneath 

Apple DOS (BAD) by Don Worth and 
Pieter Lechner 

This is a softkey which I have extended a 
bit to help out those of you who are just 
beginning the art of deprotection. I've read the 
complaints readers have about softkeys either 
being too short or not explaining what has been 
changed. I will go through several steps that 
I usually follow which will culminate in a 
softkey. 
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Before we start off, let's get something 
straight. If terms like prolog, epilog, disk 
formatting, checksums, and direct disk 
accessing are foreign to you, then I suggest you 
go out and pick up a copy of Beneath Apple 
DOS (BAD). It really is an excellent book on 
the subject of disk input/output and covers the 
structure of DOS 3.3 quite well. After you have 
bought your copy, there are three things to do: 
read, read, and read more. Don't expect the 
material to make sense at first. It takes a lot of 
work and studying before 'the light comes on'. 
If it's worth learning, it's worth working at. 

Another thing that helps tremendously is 
back issues of COMPUTIST, Sure, a lot of the 
softkeys are short, but many are not and several 
go in depth into the protection schemes. In 
addition, one of those softkeys may be for the 
same type of protection scheme that is on your 
disk! Learn as much as you can about protection 
schemes in general. This is the process 1 went 
through when I started out in the deprotection 
business, and today I think I am quite proficient 
at it. It just takes diligence and hard work. 

The Softkey Process 

The first thing I do is to find out what kind 
of protection the disk has. There are two basic 
types of protection schemes: signature checking 
and format alterations. 

Signature Checking 

A disk protected with a signature check can 
usually be copied with any whole disk copying 
program, such as the Locksmith fast copier or 
COPY A. You are able to copy the disk, but for 
some reason the copied disk will not work. 

What happens is that when the original disk 
was written, special disk drive hardware was 
used to write a specific byte or bytes to the disk. 
The Apple disk drive would be able to read 
these bytes but not write them. 

Types of signature checking include the 
infamous nibble count, bit insertion, and 
phantom bits. All are COPYA-aHt (to a large 
extent) but differ in the way they check for 
things. Again, special drive hardware is used 
to put data on the disk in such a way that a 
regular disk copy will leave out the bytes the 
protection routine is looking for. 

A nibble count looks on the disk for a 
certain byte sequence and then starts counting 
bytes until another special byte sequence is 
found. If the number of bytes between the two 
sequences is out of a certain tolerance range 
(determined by the protection scheme), then the 
protection scheme 'knows' that the disk is a 
copy and takes appropriate measures. Usually 
this results in a reboot, but other things can 
happen too. For example, say you need to get 
the magic scroll in order to get through a certain 
room, and if you do not have the scroll then 
you can not advance in the game. The protection 



scheme 'finds out' that the disk is a copy and 
alters some code so that you can never find the 
magic scroll, ergo you can never get past that 
certain room and you are stuck, unable to go 
any further. Keep this in mind when you 
supposedly deprotect a game: make sure you 
have removed the protection entirely. 

Bit insertion and phantom bits (sometimes 
referred to as weak bits) are beyond the scope 
of this article. I suggest you bone up on chapter 
3 in BAD and go through lots of old 
COMPUTISTs for help on these. 

Format Alterations 

Format alterations are some of the easier 
(to me) types of protections to deal with, if they 
are the only protection a disk has. A format 
alteration is one in which the actual format of 
the disk has been changed from the normal . One 
of the following generally has been changed on 
these disks: address prolog, data prolog, 
address epilog, data epilog, address checksum, 
data checksum, or the nybble translate tables. 

There are some disks, like the Essential 
Data Duplicator and the Flight Simulator n, that 
have drastic format changes which may or may 
not include the above items. These nasty disks 
deviate away from standard 16 sector format 
and I will not go over how to deprotect them 
since each one must be individually examined. 

Changes that have been made to either the 
prologs, epilogs, or the checksums are found 
out easily with the help of a nibble editor. A 
nibble editor disregards the format of the disk 
and just reads in an entire track at a time and 
then displays it in raw nibble format. 

Looking at the display, you should find the 
following: a large group of bytes in normal text, 
15-20 bytes in inverse text (usually with the 
value of $FF), 13-16 bytes in normal text, and 
5-1© bytes of inverse text. This pattern should 
repeat itself 16 times on the track since there 
are 16 sectors per track. 

The large group of normal bytes is the data 
area. The data area's first three bytes compose 
the data prolog. The third byte from the end 
is the checksum. The last two bytes compose 
the data epilog. The 15-20 bytes of inverse text 
are the sync gap between the data and address 
areas. 

The next group of 13-16 bytes are the 
address header which is broken up into address 
header (3 bytes), volume # (2 bytes), track # 
(2 bytes), sector # (2 bytes), checksum (2 
bytes), and the address epilog (2 bytes). The 
value of the checksums, non-prolog, and non- 
epilog data depend on the information contained 
within the sector. 

The values of the prologs and epilogs on 
a normal DOS 3.3 disk are: 

Address prolog D5 AA 96 

Address epi log -DE AA 

Data prolog DS AA AD 

Data epilog DE AA 



Go ahead and try a nibble editor out on a 
normally formatted DOS 3.3 or ProDOS disk 
and hunt for the above bytes. Get proficient at 
finding them and when it comes time to find 
them on a protected disk, you will generally not 
have a problem. 

Another tool to use is a disk scanner, such 
as Lixksmith'f, Quick Disk Scan. What this 
shows you are the sync gaps and sectors on a 
track. The sync gaps are represented by white 
dots and the sectors arc represented by no dots. 
Looking at the output, you can count the 
number of sectors and if it is around 16-17 then 
you have a 16 sector format disk. Again, try 
the disk scanner on a normal DOS 3.3 or 
ProDOS disk to see what a 16 sector disk's 
display looks like. DOS 3.2 disks have larger 
sector sizes and less sync gaps and with some 
experience it becomes easy to distinguish 
between 13 and 16 sector format. 

Other types of format alterations include 
track synchronization and non standard tracking 
(half tracks, quarter tracks). Half tracking is 
used by Electronic Arts quite frequently. Tracks 
$5, $5.5, and $6 are all formatted the same way 
and the Apple drives can read half tracks with 
(usually) no problem. The bug is when it comes 
to writing half tracks, the drive does not have 
the reliable precision to write a half track 
without writing over the data a halftrack away 
on both sides. 

Track sync involves writing data to a disk 
in such a way that when the protection scheme 
moves the drive head from one track to another, 
it expects to find the correct data immediately. 
I will not go over format alterations that involve 
anything other than 16 sector disks because once 
again, each disk must be handled individually. 

Disks protected with alterations to their 
prologs or epilogs are generally easier to 
deprotect. Often, all you have to do is read the 
disk using their format and then write to another 
disk using normal 16 sector format. Super IOB 
is ideal for this and 1 refer you to Ray Darrah's 
article in COMPUTIST #32 for directions on 
what it does and how to write a controller for 
it. After the disk has been converted to normal 
format, all that is required is to either put a 
normal DOS onto it or edit the disk's read 
routines so that it can now read in the normal 
format. DOS 3.3's disk read routines are 
located around $B800-$B950 or so. Boot DOS 
3.3 and look at them sometime using the 
monitor list (L) command. 

The routine looks something like this: 



B8E1- 
B8E4- 



BD 8C C0 

10 FB 



LDA $C08C,X 
BPL $B8E1 



What these 5 bytes of code do is to read 
a byte off of the disk. Usually, right after these 
bytes is a CMP statement that compares what 
was read to a value. If that value is anything 
other than the normal prolog or epilog bytes, 
it is immediately suspicious. 
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For example, say you deprotected a disk 
with a data prolog of D5 AA CD. You've 
already converted the disk to normal 16 sector 
format. Now, you have to find where it was 
reading in that CD value. Using your disk 
searcher/sector editor you searched through the 
disk, starting at track $©0 sector $©0, for the 
byte sequence 8C CO. You found it and a 
disassembly of the code around it looked 
something like this: 

E80- BD8CC0 LDA $C08C,X 

£83- 10 F8 BPL $E80 

E85-C9CD CMP #$CD 

E87- D0 03 BNE SE8C 

Well, there is the code that read in the CD 
byte. All you have to do is to change the C9 CD 
to C9 AD and the disk should now have the ability 
to read itself. 

NOTE: disks protected with format 
alterations may also have signature checks too, 
so don't forget to thoroughly check your 
deprotected disk. 

Now, to the Main Attraction 

Now that we have gone over several 
different types of protections, it is time to deal 
with the title program: BDCS. Interestingly 
enough, BDCS is protected with the EXACT 
same protection scheme as California Games. 
In fact, 1 tried my California Games 
deprotection in COMPUTIST #52 and it 
deprotected BDCS perfectly! 

Step One 

First of all, the disk is protected with a 
format alteration. COPY A doesn't work and the 
Locksmith fast copier comes up with lots of 
inverse characters (not a good copy). So, it's 
time to load up the trusty disk scanner. This 
reveals a 16 sector format. A quick check with 
the nibble editor reveals that the alteration is 
not a prolog alteration . Back in my Information 
Master softkey (COMPUTIST #43, page 23), 
I listed what bytes to change to ignore certain 
bytes and errors. POKE 47426,24 (or B942: 18 
from the monitor) disables DOS 3.3's epilog 
and checksum error checking. This is what we 
need. After typing in the POKE, I then typed 
RUN COPYA and copied the BDCS disk onto 
a blank. Try to boot the disk up and you are 
rewarded with a reboot a few seconds after the 
disk boots. Ah hah! Another protection! 

Looking for the Other Protection 

When looking for a signature check, you 
can either boot code trace the disk (if the check 
is early in the boot) or search the disk for the 
byte sequence 8C CO (direct disk access code). 
Since the reboot occurs fairly early in the boot 
process, I decided to boot code trace the disk, 
but not in the normal fashion. I used my sector 
editor to read in track SO© sector $©© and then 



disassembled the code in the sector starting with 
relative byte $©1 . Refer to pages 5-6 to 5-8 and 
8-1 to 8-3 in BAD for more information on the 
booting process. Looking down the 
disassembly, I was only interested in JMP 
commands. At relative byte $4A, there is a 
JuMP to $BB0©. Now, if you look at track 
$0© sector $00 of a normal DOS 3.3 disk, 
there should be an indirect JuMP to $8FD 
(which finally ends up JuMPing to $B700) at 
relative byte 4A. In fact, up to that point the 
BDCS and normal boots are the same. Hmmm. 
Could it be that a signature check of some sorts 
is at $BB©0, and when it is done it will JuMP 
to $B700? Well, let's take a look. On the disk, 
$BBO© corresponds to track $©0 sector $©5. 
Read in that sector using your sector editor and 
you will see the following disassembly. I have 
commented the code a bit in the hopes that you 
might better understand the protection. 

Main Protection Code (SBBOO) 



00 LDA #m 


Zero locations $F0-F7. 


02 LDX #$F0 




04 TXS 




05 STA $00. X 




07 INX 




08 BNE $BB05 




0A LDA «0A 


set up # of retries 


0C STA JFC 


retries location 


0E LDX $2B 


get slot § 


30 LDA $C089,X turndnveon 


13 LDA $C08E,X enable READ mode 


16 LDA #$80 




18 STA $FD 




1A DEC $FD 




1C BEQ $BB98 


Bad 


IE JSR $BBF5 


find correct track 


21 BCS $B898 


Bad 


23 LDA $F9 




25 CMP #$0A 




27 BNE $BB1A 




Check the disk for a certain sequence of 


header bytes. 




29 ldy #$00 




2B LDA $C08C,X 




2E BPL $BB2B 




30 DEY 




31 BEQ $BB98 


Bad 


33 AND #$00 




35 BNE IBB2B 




37 LDA #$00 




39 LDA $C08C,X 




3C BPL IBB39 




3E DEY 




3F BEQ $BB98 


Bad 


41 AND #$00 




43 BNE $BB39 




45 LDA $C08C.X 




48 BPL $BB45 




4A AND #$00 




4C BNE $BB98 


Bad 


4E LDA $C08C.X 





51 BPL 

53 AND 
55 BNE 
57 LDA 
5A LDY 
5C BIT 
5E LDA 
61 BPL 

63 DEY 

64 BEQ 
66 AND 
68 BNE 
6A NOP 
6B NOP 
6C LDY 
6E LDA 
71 BPL 
73 STA 

76 NOP 

77 DEY 

78 BPL 



$BB4E 

#$00 

$BB98 Bad 

$C08D,X 

#$10 

$80 

$C08C,X 

$BB5E 

$BB98 Bad 

#$00 

SBB5E 



#$07 Start at $F7, go down to $F0 

$C08C,X 

$BB6E Correct sequence of header 

$00F0,Y bytes found, so ioad$F0-$F7 
with sequence of bytes found 
after header byte sequence. 

$BB6E 

Decode next stage ($B70©-B9FF) & 
execute. 

7A LDX #$03 
7C LDA #$00 
7E TAY 
7F STA $F8 
81 LDA #$B7 
83 STA $F9 
85 LDA $F0,X 
87 EOR ($F8),Y 

89 STA ($F8),Y 
8B DEY 

8C BNE $BB85 
8E INC $F9 

90 DEX 

91 BPL JBB85 
93 LDX $2B 
95 JMP $B700 



Page to start decoding. 

Get value from $F0-$F3. 

Em byte 

Put decoded byte back. 



Mew page to decode, 



Get slot ft. 

Jump to decoded next stage. 



Come here if something bad was detected. 



98 DEC $FC 
9A BEQ JBB9F 
9C JMP $BB16 

9F INC $03F4 

A2 JMP $BB95 



decrement i of tries loc. 

have we used up our tries? 

no, try again. 

yes, alter RESET vector to 

reboot. 

next stage not decoded, so 

crash. 



Seek correct track subroutine. 



A5 LDY #$FD 
A7 STY $F0 
A9 I NY 
AA BNE SBBB0 
AC INC $F0 

AE BEQ SBBED 



#of tries to findD5AA96. 

store it. 

increment i of tries. 

wore tries? 

no, increment bad result 

location. 

correct track not found. 



Look for D5 AA 96 sequence. 

B0 LDA $C08C,X 
B3 BPL $BBB0 
B5 CMP #$D5 
B7 BNE $BBA9 
B9 NOP 
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BA LDA 
BO BPL 
BF CMP 
CI BNE 
C3 LDV 
C5 LDA 
C8 BPL 
CA CMP 
CC BNE 



SC08CX 

$BBBA 

#$AA 

$BBB5 

#$03 

$C08C,X 

$BBC5 

#$96 

5BBB5 



Found correct track. 

CE LDA #$00 
D0 STA $F1 
D2 LDA SC08CX 
D5 BPL $BBD2 
D7 ROL 
D8 STA $F0 
DA LDA $C08C,X 
DD BPL $BBDA 
DF AND $F0 
El STA $00F8,Y 
E4 EOR in 
E6 DEY 
E7 BPL 
E9 TAY 
EA NOP 
EBCLC 
EC RTS 
ED SEC 
EE RTS 



good result 
bad result 



What happens is that the code from $BB00 
to SBB79 searches the disk for a certain 
sequence of bytes. When it finds them, it loads 
the next 8 bytes after the sequence into memory 
locations $F0-$F7 . $BB7A to $BB97 uses these 
bytes to decode the next stage of the boot code 
at $B700-$B9FF. After decoding, the next 
boot stage at $B700 is JuMPed to at $BB95. 
What we have to do here is to load the correct 
values into $FO-$F7 and then jump to the 
decode routine. The following code will do that 
nicely: 



A9FC 


LDA #$FC 


85 F0 


STA $F0 


A9EE 


LDA (f$EE 


85 Fl 


STA $F1 


A9EE 


LDA #$EE 


85 F2 


STA $F2 


A9FC 


LDA #$FC 


85 F3 


STA $F3 


A9E7 


LDA «E7 


85 F4 


STA $F4 


A9EE 


LDA HEE 


85 F5 


STA $F5 


A9FC 


LDA *$FC 


85 F6 


STA $F6 


A9E7 


LDA #$E7 


85 F7 


STA $F7 


4C 7A BB 


J MP JBB7A 



I discovered what the correct bytes were 
by breaking into the monitor early in the boot 
process and displaying what was in $FO-$F7. 
After making these changes to track $0© sector 



$05, I found that the program (to my 
knowledge) works perfectly. 

I hope that this softkey will help out those 
of you who are just starting out in the art of 
deprotection. It is a fascinating hobby and you 
really learn a lot from your computer, contrary 
to what many people say. 

Step by Step 



I 1 I Boot up DOS 3.3 and disable error 
checking: 

POKE 47426,24 



Copy the BDCS disk: 



RUN COPYA 



I 3 I On the copied disk, make the 
following changes: 

Trk Set Byte(s) From To 

$00 $05 $00-? 



A9FC85F0A9EE85F1 
A9 EE 85 F2 A9 FC 85 F3 
A9 E7 85 F4 A9 EE 85 F5 
A9 FC 85 F6 A9 E7 85 F7 
4C 7A BB 



A. Evans 



A.P.T.for. 



Moebius 

Origin Systems 



■ Requirements 

□ Sector Editor 

□ Moebius Realm disk (sides C &. D) 

This APT is contributed in response to 
Dennis Gaunt's request in COMPUTIST #52 
and also as a guide to those of you who are still 
struggling with this game. 

It seems Origin Systems is consistent in its 
design of games where detailed character 
information resides on an unprotected second 
disk. With this in mind, I found saved character 
information on disk sides C and D (depending 
on which realm your character was last saved). 

I 1 [ Boot Moebius and make note of your 
character name(s) and the realm(s) associated 
with each character "on an adventure". 



I 2 I Remove Moebuis disk and boot your 
sector editor. 



I 3 I Search Moebuis disk side C (Earth 
and Water realms) or side D (Air and Fire) for 
the sector that contains the name of your 
character. (I have found some of my character 
names at various locations such as tracks $16, 
$17, $1A, $22, $23, and $26 with varying 
sector locations.) 



I 4 | Use the following table to enhance 
your character. Maximum value at these 
locations is 255 ($FF) unless noted by '*'. 

If, for example you found the character 
name that you were looking for on track $17, 
sector $05, you would find the following 
information: 



ATTRIBUTE 


BYTE 


Name 


$00-$0F 


Experience 


$12,$13 ($13 * 256 + $12) 


Level 


$14 


Body points 


$15 (limit), $16 (current) 


Mind points 


$19 (limit), $1A (current) 



Possessions and magic items are found on 
the next consecutive sector. (IE. Track $17, 
sector $05 — track $17, sector $06 or track 
$16, sector $0F — track $17, sector $00.) 



POSSESSIONS BYTE MAGIC ITEMS 



BYTE 



Food 


$44 


Tiger teeth 


$64 


Water 


$45 


Beetiepincers 


$65 


Torches 


S46 


Soi 1 sample * 


$66 


Whetstones 


$47 


Fish scales 


$67 


Body El ixirs 


$48 


Condor feathers 


$68 


Mind El ixirs 


$49 


Panda hair 


$69 


Shovel * 


$4A 






Amulet * 


$4B 






Lives 


$4E 






Shurikens 


$4F 







* Value should be $01 if you have it, or 
$00 if you don't. 



Paul R. Wilson 



A.P.T.for., 



HXR.O. 

Activision 



Using the crack for H.E.R. O. on page 22 
of COMPUTIST #52, before doing step 6, add 
the following self modifying code patch. 

3O0;A9 38 20 AS FC AD 00 CO C9 DO F© F9 
30C:C9 C6 DO 08 A9 05 8D 8D 60 4C E2 60 
31&C9 D3 DO 05 A9 00 8D BS 60 4C E2 60 
6OB4:20 05 03 was 20 E2 60 

Then do step #6 and add 
BSAVE PATCH,AS300,L$28 

Be sure to BLOAD PATCH along with 
H.E.R.O. when loading the game into memory. 

Now H.E.R.O. has three additional 
keyboard commands. 

F - normal speed 

P - pause (missing in original game) 

S - slow speed (essential for some very tight 
spots that almost always take a game Life when 
negotiated at normal speed) 
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Playing Tips for.. 



Castle Wolfenstein 

Muse 



I 1 | Copy your cracked disk and label the 
"original" Disk 1. LabelVthe copy Disk 7, 



| 2 | Play on disk 1 to a good point (Like 
you have 10 bullets, 3 grenades, a vest, a 
unifor m and the war plans and swap to disk 2. 
Press I ESC [ to "save" (there is no true save 
feature on the game and if you resume and get 
caught or shot on the resumed game, it's back 
to room 1 with only 10 bullets. Worse, if you 
blow yourself up with a grenade, you lose the 
entire castle map! If you were playing a terrific 
game and getting near the exit, bye-bye 
progress and all your maps are now waste paper 
as the map is re-randomized.) 



I 3 I Resume on disk 1 and upon finishing 
the room, swap to disk 2 and exit. Play until 
you get caught or killed. Resume on disk 1. 



| 4 | Now comes the fun part! You will 
have all the ammo and stuff you started with, 
but your damage is still there! Rooms full of 
dead men, rifled trunks, grenade holes (rare) 
and only an occasional S.S. man will show up. 
Hold them up with a gun or grenade. In this 
reality warp, bullets shot or grenades used, or 
even the loss of vest and disguise will be 
repaired, but the damage (progress) remains. 
You can resavc to disk 1 to avoid a long 
sequence of leaned out Nazi rooms (and 
Confronting S.S. men), and it'll only be a 
matter of an hour at most before you reach the 
coveted exit, and perhaps a promotion! 



| 5 | If a room proves intractable, siccing 
an S.S. man on you before you can even get 
into it, warp reality by swapping to disk 1 
before entering this room. 

WARNING: Switch back to disk 2 should 
that replacement room get too hot. Lest it get 
saved to disk 1 as you get offed and your 
progress is erased. 

This A.P.T. requires a new line of strategy, 
but it makes Castle Wolfenstein playable, 
instead of frustrating. 

Sometimes you may suffer a drop in rank 
should you get shot. This is not fair and you 
should use A.P.T.s from COMPUTET to undo 
this. 

Remember: 
Disk 1 - Boot and Start Game on this 
Disk 2 - Play game on this 

At higher levels, vest wearing Nazis 
increase in frequency. 

I've gotten to level 6 this way. 



Steven Heckler 



(35) I have a technical question 
concerning the Apple lie. How do you run 
quarter tracked programs like Karateka (original 
version), Choplifter, Starblazer, and the old 
One-on-Onel 

I noticed in your listing of back issues that 
you had an article titled "Playing Karateka on 
a lie (COMPUTTST #37, 1 believe). I know I 
must sound like a mooch since I do not 
subscribe to your magazine, but no one I have 
talked to has had any idea how to run the quarter 
tracked programs on the lie. 



s 



According to Christopher Dean 
(COMPUTIST #52) the problem with II plus 
and He programs that don 't boot on a He is 
caused by the different Boot0 code in ROM. 
Programs that use the ROM BootO code 
directly will not work on the He without 
modifications. He goes on to show how to make 
these changes using Drol, Hardball, Orge and 
Arctic Fox as examples RDEXed 



James E. Bulman 



As a new subscriber to COMPUTIST, I 
would like to express my thanks for an excellent 
magazine. [ was especially pleased with my first 
issue, COMPUTIST #52. With it, I was able 
to copy two of my copy protected programs 
(Ultima I and Shanghai). With that said, I would 
like to offer some constructive criticism. 

1) Clearly list the softkeys in your back 
issues. I ordered several back issues only to find 
the softkeys were for the Apple Ilgs (I have a 
He). Softkeys in back issues that require 
information from other back issues should also 
be noted. (The Carmen Sandiego softkey in 
COMPUTIST #25 requires information from 
COMPUTIST #19. 1 have ordered #19 praying 
that the modified F8 ROM is NOT a hardware 
modification!) 

2) When softkeys in current issues refer to 
previous issues, re-list the information from 
those issues. (The softkey for Math Blaster in 
COMPUTIST #53 is an example.) I realize this 
would cut down on back issue orders but it 
would also reduce reader frustration. 

Thank you again for a fine computer 
magazine, I am learning more and more with 
each issue. 

3E The modified F8 ROM is hardware, but 
you could get the same effect using Senior 
PROM on your He, 

We usually don *t reprint softkeys because 
of the wealth of new material that arrives here 
every day. It is difficult to justify reprinting old 
material when the next issue is already full and 
letters recieved today must wait for the issue 



alter next. Our focus is to get your letters 
printed as quickly as possible RDEXed 



Playing Tips for. 




• The bat on the first board can be killed without 
losing a sword. 

• Stay on the bubble for as long as you can. 

• Collect swords and a jewel on the fourth level. 

• You have to kill six dragons before the door 
will unlock on the fifth level. 

• The eyes will help you build a ladder on the 
sixth level. 

• If you run into trouble on the seventh level, 
you can always drop back one. 

I have a suggestion. How about someone 
starting a beginner's column. You could explain 
some of the more common protection schemes, 
how to find what protection is being used and 
how to break the schemes once you find them. 

CJ) I have a Pineapple brand Apple 
compatible. Several keys can be pressed down 
but nothing is registered in the CPU the broken 
keys are: 1, ESC, Cfrl-A, 5 (on the numeric 
keypad) and shift Z. Does anyone know if this 
can be fixed or, if it's not fix able, where 1 can 
get a replacement keyboard? My address is 
P.O. Box 265, Claverack, NY 12513 



David M. Widman 



Softkey for.. 



Hacker II: 
The Doomsday Papers 



Activtsion 



■ Requirements 

□ Apple II series with 64k (minimum) 

□ Hacker H disk 

□ A blank disk 

□ COPYA 

Hacker His a very good program, as well 
as Hacker. This time the government needs a 
little favor; as a computer wizard you must hack 
your way through Siberian hazards in a 
maximum security complex. About the 
protection, it is almost the same as Hacker, 
there is a subroutine that checks track $00 from 
the disk and puts a FF at location SFC and a 5b 
at another special location that is verified by 
the program. 
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Step-by-Step 



I 1 I Copy the Hacker II disk with 
COPY A. 



I 2 I Put your COPYAed disk in drive 1 
and enter: 

BLOAD HACKER H HELLO.D1 
CAUrlSl 

G3C9:A9 FF 35 FC A9 55 4C 10 64 
8SAVE HACKER II HELLO, AS600ffl,L$58S 

You are done! 
Softkey for... 



Labyrinth 

Activision 



■ Requirements 

□ Apple lie or He with 128k (minimum) 

□ Labyrinth disk 

□ A blank disk 
COPYA 

Labyrinth is an animated adventure game 
with double hi-resolution animation and a very 
attractive scenario. About the protection, it is 
almost the same as Hacker and Hacker II, there 
is a subroutine that checks track $00 and puts 
an FF at location $FC and puts a 55 at another 
special location that is verified by the program. 

Step-by-Step 



I 1 I Copy the two sides of the Labyrinth 
disk with COPYA. 

I 2 I Put your COPYAed disk side one in 
drive 1 and enter: 
BLOAD B00T2.D1 
CALL- 151 

8B9:A9 FF 85 FC A9 55 K 00 09 
BSAVE BOOT2,A$80O,LS279 

Now you have a COPYA -able version of 
Labyrinth. 



UNK, Prince George, Canada 



Softkey for. 



Arctic Fox 

Electronic Arts 



After reading my first issue of 
COMPUTIST which was #53, 1 found a much 
easier way of deprotecting Arctic Fox than 
doing all the sector edits proposed in Scott M. 
Simon's softkey. After reading the softkey for 
Earth Orbit Station, I noticed that it also, when 
copied, showed many errors in track $06. Since 
Arctic Fox was also an EA disk, I tried it. To 
my relief, it worked. Since I had already typed 



in Earth Orbit Station it was much easier than 
doing all those sector edits. I wouldn't be 
surprised if it worked on other EA wares. Many 
thanks to Bob Wilson! For any of you who 
missed Bob Wilson's controller, here it is. 

Controller 

1000 REM EOS/ARCTIC FOX 

1010 TK = 0: LT = 35:ST= 15 :LS= 15:00 = NR: FAST 

= 1:HB = 55 
1020 GOSUB 490: GOSUB610: IF TK = 1 THEN Tl = 

TK:TK = PEEK (TRK): GOSUB 310TK = Tl 
1030 GOSUB 490: GOSUB 610: IF PEEK (TRK) = LT 

THEN 1050 
1040 TK = PEEK (TRK) : ST = PEEK (SCT) : I F TK = 6 

THEN TK= 7:MB = 151 
1045 GOTO 1020 

1050 HOME : PRINT "COPYDONE" : END 
5000 DATA 6'CHANGES 
5010 DATA1. 10. 82,24 
5020 DATA1. 10,83,96 
5030 DATA 1, 10,84,72 
5040 DATA1, 15, 0,24 
5050 DATA1, 15, 1,96 
5060 DATA 1 ,15,2,221 



Controller Checksums 



1000 - S356B 

1010 - S99DD 

1020 - $1705 

1030 - $5B83 

1040 - $2403 

1045 - JA200 

1050 - $9FA4 



5000 - $3561 

5010 - $5711 

5020 - $3260 

5030 - $5F61 

5040 - $0AEA 

5050 - S5B72 

5060 - SC15F 



Jim S. Hart 



Softkey for. . 



Math Blaster 

Davidson and Associates 



■ Requirements 

□ Math Blaster original disk 

□ 2 blank disk sides 

□ SUPER IOB vl.5 with both NEWSWAP. 

CON and FAST.CON controllers (from 
Starter Kit) 

□ Word Attack/Classmate softkey from 
COMPUTIST #28 for reference 

■ Optional 

D "Beneath Apple DOS" for an explanation 
of what format changes are 

□ A fast DOS such as Diversi-DOS or 

ProntoDOS (not necessary but helpful) 

Math Blaster is a user-friendly math tutorial 
and drill that emphasizes the fundamentals. 
Students and teachers alike have applauded the 



effort that Davidson & Associates put into 
making the programs as well written as 
possible. They came up short, however, in the 
ease of making backups. Parents, once finding 
out that the disks cannot be copied, usually will 
not let their kids use the program unless they 
are around for fear of the disk crashing. Never 
fear, COMPUTIST is here to alleviate your 
worries (and keep money in your pocketbook). 
Below are the steps to follow to get rid of the 
annoying format protection along with a nasty 
secondary protection scheme. 



| 1 ] Boot up DOS 3.3, initialize the two 
blank disk sides, and delete both hello 
programs. I have only tried Divcrsi-DOS, 
ProntoDOS, and standard DOS 3.3, so you take 
your chances if you use some other type, 

INIT HELLO 
DELETE HELLO 



I 2 | First of all, wemust convert tbcMath 
Blaster disk to normal format. The easiest way 
to do this (usually) is to capture the perverted 
disk's RWTS, and then use the NEW SWAP 
controller with Super IOB vl,5 to read the disk 
in with it's own RWTS and then write it out 
to a normal disk using normal RWTS. 

The problem is how to get the RWTS. It 
turns out not to be too hard. Boot up the Math 
Blaster disk and when the Applesoft prompt (}) 
appears, open your disk drive door. There will 
be some rattling and then you get an I/O 
ERROR message. At this point, I discovered 
that you cannot type in any commands. This 
means that the BASIC RUN flag at $D6 has 
been set to a value greater than 127. This causes 
BASIC to interpret all commands typed in at 
the keyboard as 'RUN". 

A little known fact is that DOS commands still 
work. The DOS command 'FP' resets all 
pointers to their defaults, even the BASIC RUN 
fiagl 

Ah ha! If you try this, you will discover 
that the DOS commands have been altered a la 
Beagle Bros DOS BOSS. 

To make a long story short, I went a- 
huntin' through memory via a copy card and 
discovered that FP had been renamed PF. Type 
this in and you can now execute all other 
commands such as CATALOG, LIST, etc: 

PT 



I 3 I Now we need to move the RWTS to 
a safe area so a normal DOS disk can be booted. 
Move the RWTS and then boot the blank 
initialized disk: 

CALL -151 
19OO<B80O.BFFFM 

Insert the blank initialized disk. 
C600G 
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~4~~| Save the RWTS. 



BSAVE RWTS.MATH,A$19OO,L$8O0 



[~5~| Load SUPER IOB VI. 5 and install the 
NEW SWAP controller. Then add the following 
lines to copy Math, Blaster. 

LOAD SUPER IOB \ 

EXEC NEWSWAP.CON 

1015 TK = 3 

10010 PRINT : PRINT CHRS (4) "BLOAD 

RWTS.MATH" 
RUN 



| 6 | Now clear memory, load SUPER IOB 
VI. 5 again, install the FAST controller into it, 
add two lines, and RUN the result to copy the 
Math Blaster data disk onto the second blank 
initialized disk: 

FP 

LOAD SUPER IOB 

EXEC FAST.CON 

1020 POKE 47426,24 : GOSUB 490 : COSUB 

610 
1030 POKE 47426,56 j GOSUB 490 : GOSUB 

610 : IF PEEK (TFK) = LT THEN 1050 
RUN 

(Note: this altered FAST controller can 
convert a surprising number of older 
educational disks into normal format.) 



I 7 I Put away your original Math Blaster 
disk. We're done with it. 



| 8 \ Boot up normal DOS and then insert 
the copied Math Blaster program disk into the 
drive. 



| 9 | Rename their boot program so we can 
add our own: 
RENAME HELLO, MATH 



| 10 | Type in the one line BASIC program 
below and then save it to the Math Blaster 

program disk: 

10TEXT : HOME : HTAB15 : PRINT""MATH A BLASTER' ' 
: PRINT : POKE 47721.96: POKE 47741,96: 
POKE 40222 ,87: POKE 40223, 255: PRINTCHR$ 
(4) "" RUN' MATH " 

SAVE HELLO 



j U | Write protect the disk and you are 
done! 

For the adventurous (or curious) among 
you, 1 suggest reading Dave Stanton's "Word 
Challenge/Classmate" softkey in COMPUTIST 
#28. He talks about programs hidden within 
programs which is exactly what the situation 
with Math Blaster is. 

Throughout the programs, there is a nasty 
secondary protection that will, upon discovering 
normal DOS 3.3 present, initialize your disk. 
Calls are made to the start of the DOS 3.3 INIT 
routine which in the Math Blaster DOS has a 
Return from Subroutine (RTS) command. I 



found this out quickly when, upon first booting 
the supposedly soitkeyed disk, it reinitialized 
the disk! Other checks are made and if things 
are not what they arc 'suppposed' to be, an 
indirect call is made to the INIT command. 

I found a few occurrences of these two 
checks, but since there were programs hidden 
within programs, I decided to fix the INIT 
routine in normal DOS so that it would mimic 
Math Blasters original DOS. 

This entailed putting two RTS's at the INIT 
entry points (line #40 in our new HELLO 
program) and changing the pointer which the 
second check uses to call INIT into a harmless 
call to monitor RTS at $FF58 (line #50). For 
a simple lesson, copy the softkey cd Math 
Blaster program disk onto another blank disk 
which we'll call the "DUMMY' disk. Now 
DELETE the HELLO program on the 
DUMMY AND RENAME MATH, HELLO. 
This returns the disk to it's original volatile 
state, Boot this disk and listen closely. BINGO. 
The disk reinitializes itself! 

The moral to this is to write protect any 
newly softkeyed disk to prevent much 
frustration until you are absolutely sure there 
is no secondary protection lurking around. 

Enjoy your deprotected Math Blaster) 

Softkey for... 



Tuesday Morning Quarterback 

Automated Simulations 



■ Requirements 

□ 64K Apple 11+ or the ability to RESET into 

the monitor at will 

□ Tuesday Morning Quarterback original 
n A blank disk 

U File copy program such as FID 

□ Fast DOS (not necessary out helpful) 

When the football season rolls around, I get 
to watch plenty of action on the field. Football 
is my favorite sport and I can never watch 
enough of it. After the season is over and 
football is no more for 4-5 months, 1 satisfy my 
football cravings with Automated Simulations' 
Tuesday Morning Quarterback. 

It is an excellent simulation even though 
the screen graphics arc a bit slow and sparse. 
The game cannot really be enjoyed, however, 
unless there is no chance of the original 
crashing. This is so you will not have to wait 
for the backup to arrive via the mail (which 
takes time and $$$). 

Deprotecting the disk is one way to prevent 
those fears. Follow along with the steps in this 
article and when you are done your program 
will be COPY A -able which translates to "No 
more hassles!". 

NOTE: Folks who have the ability to reset 
into the monitor should ignore instructions 



pertaining to the I6K RAM card. 

| 1 | Initialize the blank disk, preferably 
with a fast DOS such as ProntoDOS or Diversi- 
DOS. and delete the hello program: 

INIT HELLO 
DELETE HELLO 



[ 2 | After the blank has been initialized, 
drop down into the monitor and set up the 1 6K 
RAM card so that it contains an image of 
BASIC and the monitor in it. We also need to 
change the reset vector (i.e. where the computer 
goes when the reset key is pressed) so that it 
points to the monitor. This emulates those Non- 
Maskable Interrupt cards that allow you to go 
into the monitor at will. Capturing the protected 
(and encrypted) Applesoft files requires that we 
have this ability. For more information 
regarding RAM cards, check out Wes Felty's 
"More ROM Running" article in 
COMPUTIST #34. 

CALL- 151 go into monitor 

C081 C081 assumes slot MM card 

D000<D000.FFFFM move ROM image 

FFFC&9 FF change reset vector 

COSO enable MM card 



| 3 I Insert the Tuesday Morning 
Quarterback (TMQ from now on) original into 
drive ffl and boot it: 

C600G 



SSETl 



When the first screen comes up, press 
I RESET I to go into the monitor, 

| 5 | What we must do now is move part 
of the Applesoft program to a safe place so that 
a boot will not wipe it out. This involves 
checking out where the program end is, writing 
it down for future reference, and then doing the 
actual memory move. First let's see where the 
program end is: 

AF.B0 

Write down t he two he x digits that show 
up after you press IHBTURN I _ we'll need them 
in a moment. Now move the section of the 
Applesoft code that would be destroyed by a 
boot to a safe place: 

7000<800.SFFM 



| 6 | Now boot up the blank initialized disk. 
You will get a "FILE NOT FOUND" error 
when there isn't a program named 'HELLO' 
found on the disk. For right now that is fine 
because nothing will be loaded into memory 
which would cause us to move more memory 
(yuch). We now have to move the beginning 
of the program back in place and then inform 
DOS and BASIC of its length: 

800<7000.70FFM 

AF:xx yy P«t the two bytes you wrote 

down earlier in place ofxx and yy 
3D0G 
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I 7 | We will now save the program to disk 
then set the computer back up so that another 
protected BASIC tile may be loaded. 
SAVE STARTUP 
CALL -151 
C080 

insert the TMQ original disk into the drive 
C6Q0G 



| 6 | For the rest of the BASIC files on the 
TMQ original you will have to follow the steps 
from 5 to 7 using the different file names and 
RESETing into the monitor at the different 
times shown in the list below. 

The list order is — Filename — end of 
program value (from SAF-B0) — when to press 
I RESET I _. 

For example, to get the file "MENU", you 
have to wait until a menu showing the different 
choices, such as play football or practice 
kicking, comes up before you press I RESET i 
to go into the monitor. From there on follow 
steps 5 to 7 and save the file with the name 
"MENU" in place of "STARTUP'. 

|_9_J When you are done with the above 
steps, you will have live BASIC programs on 
the copy disk with the names STARTUP, 
MENU, KICK PRACTICE, TEAM FILE 
EDIT, AND TUESDAY MORNING 
QUARTERBACK. Now the text files, 
containing the team's information, must be 
copied from the TMQ original to the copy. We 
are fortunate that Automated Simulations 
decided not to protect these files. FID, or any 
file copier, should be used now to copy the text 
files named NFL. DATA, SUBS, and the 
TEAM## (## = the numbers from 1 to 30, 
inclusive) files to the copy. When you finish 
copying these text files, there should be five 
BASIC programs and approximately 32 text 
files on the copy disk. 

| 10 | The final thing to do is to rename the 
STARTUP file so that it will automatically run 
upon booting: 
RENAME STARTUP, HELLO 

You now possess a deprotected copy of 
Tuesday Morning Quarterback. The files are 
now open for inspection and customization. 
Enjoy! 

List #1 

STARTUP (EF 08) at first screen. 

MENU (BS 09) when menu with 'PLAY 
FOOTBALL' and 'PRACTICE KICKING' 
options appear. Shows up right after the first 
screen, 

KICK PRACTICE (49 18) Go to menu 
and choose 'PRACTICE KICKING' option. Go 
into monitor when drive stops. 

TEAM FILE EDIT (CD OE) Go to menu 
and choose 'UPDATA TEAM ROSTERS' 
option. Go into monitor when drive stops. 



TUESDAY MORNING QUARTERBACK 

(F0 6C) Go to menu and choose 'PLAY 
FOOTBALL' Option. Go into monitor when 
drive stops. 



Dr. Leigh Rowan-Kelly 



I sent a short version of the method to 
remove the protection from Softswitch and a few 
other programs. I have now found that, with 
regard to Softswitch, my version was grossly 
inadequate. Another disk had the code in 
another place, so I have now expanded my 
coverage of the softkey to include a full 
explanation. 
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Softswitch 

Roger Wagner 



Essentially Softswitch is an outstanding 
program, made poor by virtue of some very 
sneaky protection. It writes a special byte to the 
battery backed -up RAM (at address $FB) the 
first time you install the program on any disk 
using your system. This RAM has been 
designated as one of the reserved areas by 
Apple. When you boot a disk containing 
Softswitch, the program [hen checks for this 
special signature byte in the RAM, and won't 
install unless the low bits of the byte are "10", 
or else it requires the original protected disk 
to be on line somewhere. 

What this means in simple terms is that if 
you replace or disconnect your battery , or have 
your Motherboard replaced during repair or 
upgrading, you lose that signature byte and 
Softswitch hence will then work only with the 
original disk online. Given the additional 
complication that Softswitch will only install 
once (by inserting that slupid byte), then 
effectively you have a useless disk and program! 

It is possible, however, to make an 
alteration to the file /SS. SYSTEM. DISK/ 
SYSTEM/SYSTEM. SETUP/TOOL. SETUP. 2 
to correct this. You can BLOAD this file at 
S2O0O and by typing 48 A2 03 0C 22 00 00 El 
6S<2000 . 8800P you can locate the code that reads 
the byte. It was at $2BA9 on this disk. If you 
then replace that code with 48 A2 03 0C 68 68 A9 
FE 00 and then BSAVE the file back to the disk 
(naturally using a copy of your original!), then 
Softswitch no longer checks for the signature 
byte in the battery -backed RAM. You can even 
copy the file to other disks and have them install 
Softswitch in memory without going through 
the full installation procedure. 

If you can't be bothered doing it this way, 
then you can, of course, simply search the disk 
(using Copy If Plus v8.2 or Zap from Bag of 
Tricks 2 or any sector editor with search 
facilities) for that same sequence of bytes and 



change it accordingly. I found it at block $112, 
starting at byte $3D on one disk, and at block 
$1 ID, byte $4A on another. I might add that 
this was based rather heavily on a letter that 
appeared in Open- Apple, and I am indebted to 
Peter Stubbs for writing that letter, 

A The letter in question is in the Septemher 
issue of OPEN-APPLE, u publication that we 
heartily recommend. One year subscriptions are 
available for $28 from; Open-Apple, P.O. Box 
11250, Overland Park, KS 66207 
RDEXed 
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Hardball gs 

Accolade 



I see you have another crack for Hardball 
gs in COMPUTIST #53. My edits also seem 
to produce a working copy, but I only used the 
two byte changes, at block S32C. bytes 
$1EE-1EF (from C2 20 to 18 60) and block $32F, 
bytes $FF-1O0 (from DA C2 to 18 60). 

Anyway, keep the softkeys coming. 



^^^^^^^^^^^=^^^^^^=^=^^^^^^^^= 


Jan Recourt 


Playing 


Tips for... 


Ultima IV 

Origin 



1 have the solution regarding the Stigian 
problem I asked about. When you are in the big 
room with the altar in the middle, use stones. 
After that answer the questions and the rest is 
simple. 

CJ> is there anyone who can give me 
more lives in Moebiusl 

(2D Why can'i 1 put Baudville's Video 
Vegas on a hard disk or Vh" disk with Unidos 
Pius by Micro spare. This seems to be the same 
problem with Ultima IV and Auto Duel. 

When you put them on zVh" diskette after 
the startup, it searches in the 5 'A " drive for the 
rest of the game. I think there must be a change 
for the drive searching. It would be nice to have 
Ultima or Mocbius on one Vh" diskette. 



Alan Sheppard 



I have recently inquired about backing up 
EDD 4 v4.4 and was advised that 
COMPUTIST #49 had the program required. 
I was also told that the library disk contained 
the program as well. Because of this I ordered 
both the disk and magazine and started a one 
year subscription. 

I have some problems and need a little help. 
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I booted up library disk #49 disk and could 
not find any program for EDD-4, as well, 1 1 
of the 14 or 15 programs on the disk locked, 
gave mc syntax error or indicated undefined 
statement. Is there something 1 am doing 
wrong? 

Going back to the manual, 1 tried typing 
in the program for version 4.4 and initially 
thought 1 was successful. On the slave disk the 
Hello program came up with EDD-4 as well. 
I would then select EDD-4 and it would work 
fine, that is until I cold booted the disk. At first 
it appeared to work fine, a color logo came up, 
1 pressed the space bar and the nest screen 
(credits) appeared. The next press of the space 
bar would put me into the main program, 
however, when I did this the screen partly filled 
with characters and my cursor showed me that 
I was in BASIC. Can you help me with this one? 

The Starter Disk seems very good but I am 
wondering if it is possible to print out the 
documentation. 

As you can see, I am a novice, anything 
you can do to help me will be appreciated. 

Could I also get a copy of what softkeys 
are on all your library disks? 

Thanks. 



a 



The maieriat we put on our library disks 
consists of lengthy Applesoft programs, 
controllers, hex dumps, etc. In other words, 
material that would be a real pain lo type in. 
Step-by-step procedures must still be ryped in. 
Sony about the misunderstanding. 

The reason you are getting error messages 
is, you are probably trying to run a controller 
oh its own. Controllers can be easily identified 
because their names begin with "CON. ". A 
controller, as the name implies, is the control 
portion of SUPER IOB, a program on the 
Starter Kit. The controller tells SUPER IOB 
what to do and when to do it. Since it calls 
subroutines within SUPER IOB, a controller 
cannot be RUN on its own. It must first be 
merged with SUPER IOB and then RUN. 

Many of the binary programs (type B files) 
on our library disks are also part of other 
programs and are loaded or run by those 
programs. You shouldn 't try to BRUN them 
directly. Read the COMPUTIST issue carefidly 
to see which programs may be RUN/BRUN ami 
what other programs may be required. 

The softkey for EDD 4.x is of a type called 
"boot code tracing". This is a "storm the 
walls ' ' approach , where the program in 
question is followed as it loads into the 
computer. Detailed notes are kept and, step- 
by-step, each portion of the program is allowed 
to load. At the appropriate moment, when the 
program is in memory but not yet activated, the 
entire code is saved to disk as one or more files. 
This type of softkey is usually dependent upon 
a particular version of a program. If the softkey 
doesn 't work for you, there are three obvious 



paths to take. Carefully redo the softkey and 
hope you did some step incorrectly the first time. 
Write the author and hope that individual has 
time to spare to work on your problem. Or, 
write to RDEX with your question and let 
thousands of readers in on the problem. Be sure 
to give all required information , including the 
version number of the program and all steps that 
you have already tried with what results. 
Someone may already have solved that 
particular problem or be working on it at that 
very moment. 

As to printing the Start Kit documentation, 
the easiest way is if you have a text editor that 
will load the "DOC, "files. Then you could 
delete the control characters and reformat for 
80 columns: If you have Copy II Plus, you could 
use the view files option, select text and specify 
the "DOC" files then answer "Y'es to the 
printout question. 

We don 't have a list of what is on each 
librarv disk but, if you are primarily interested 
in controllers, the best deal is to gel the Super 
IOB collection. It contains all of the controllers 
thru COMPUTIST #38. (125 in all.) 

RDEXcd 



Michael A. Mahafley 



I recently subscribed to your magazine and 
I have found it excellent, but only half of what 
I am looking for. I am very interested in finding 
how to deprotect my software because 1 hate 
to work with the original disk for fear of 
something happening to it. Your magazine is 
just the thing for such a purpose and very good 
as far as that goes. However, I am looking for 
something else. The other half of what I want 
is to be able to put deproteeted programs on 
another disk with other programs. Thus 
reducing my disk count, increasing 
convenience, saving time and reducing desk 
clutter. Since I have an Apple Ilgs. I want to 
put all my programs on VA" disks. 

<2) Have you, in previous issues, 
shown how to transfer programs from 5'A" 
(DOS 3.3) to VA" (ProDOS) disks? If not, do 
you know where I can find such information? 
If this sounds like a naive question, please bear 
with me. I am a previous TRS-80 aficionado 
recently converted lo Apple and 1 am struggling 
with the differences. 

Also, I have seen a couple references to 
Senior Prom. Can you explain what it is and 
where I may obtain one. 

X In order to transfer programs from 5'A " 
disks to 3 'A " disks, the programs must be in 
normal format files on a non-protected disk. 
Many of the softkeys in COMPUTIST show you 
how to do this. Even then, incompatibilities exist 
that limit the transfers. Some files require a 
specific DOS, others make direct read/writes 



from specific block/sectors. Sometimes it is 
something as simple as hard coding the drive 
number or prefix name. So, to answer your 
question, we show you how to transfer files. If 
you have a specific program in mind, please 
name the program and address your question 
to RDEX for maximum response. 

The Senior PROM is a hardware 
(firmware) device that allows a Hc/e to interrupt 
a running program. It contains many useful 
utility programs that enhance your ability to 
manipulate programs in memory and to do disk 
modifications. It is available for $79.95 from 
Cutting Edge Enterprises. 43234c Ren Cen 
Station, Detroit, MI 48243 RDEXcd 



David Sheppaid 



Softkey for,. 



Wortgefecht 

Gessler Educational Software 



■ Requirements 

□ Apple II 48K 

□ FID 

This is a German vocabulary disk that has 
been protected by the use of alternating address 
headers on every other track. 

1 1 | Initialize a disk with your favorite fast 
DOS using HELLO as the startup program. 

| 2 | BRUN FID from your Apple system 
master. 

| 3 | Enter (9) to quit. 

| 4 | Enter the monitor, 

Cail-151 



| 5 | Enter the following: 



B942:18 
BE48:18 
B954:29 00 
803G 



dissabie errors 

dissables errors 

ignore 1st address header byte 

restart FID 



[ 6 | Place Wortgefecht in drive 1 and copy 
all the files to your initialized disk. That's all! 
It's now COPY A -able. 

Thanks for the great magazine. 



Thomas Punfoy 



1 just received the copy of my article in 
COMPUTIST #54 (Might and Magic, page 21) 
and I noticed a few mistakes in it. I am afraid 
thai some of my calculations were printed 
wrong. First, the numbers in the unmarked 
column should be 16 with an exponent. The 
exponent explains how the 16 is to be used in 
multiplying the different nibbles. 
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16 ' s place (16 1 ) 
1 's place (16 n ) 

4,096's place (16 3 ) 
256's place (16') 

1 .048.576' s place (16') 
65 . 536 ' s place {16') 

268. 440 ,000's place (16') 
16, 777, 216's place (16 £ ) 



$27 1st nibble 
2nd nibble 

$28 1st nibble 
2nd nibble 

S29 1st nibble 
2nd nibble 

S2A 1st nibble 
2nd nibble 

My example of the math part of the APT 
was nearly unreadable. The numbers should 
have been printed in a column like this: 

i.e. You have 1,694.834 experience points, 
thus: 



Softkey for. . . 



Softkey for., 



byte $27 = $72 

(7x16) (2x1) 
byte $28 = IDC 

(13x4096)(12x256) 
byte $29 = $19 



7 x 16 

2 x 1 

13 % 4096 

12 x 256 



1 x 1048576 
9 x 65536 
(1x1048576) (9x65536) 



112 

2 

53248 
3072 

1048576 
589.824 



total = 1,694,834 

I really like the new RDEX. keep up the 
good work. 



i 



Sorry for the confusion. The way a file is 
typeset j$ strongly dependent on which 
volunteer is skiing at the typesetter when your 
file comes across. Some people are just a little 
more experienced with the machinery and it 
shows RDEXcd 



Scott Lloyd 



Softkey Addendum for. 



Ikari Warriors 

Data East 



When I was modifying the Ikari Warriors 
for unlimited men. bullets and grenades, the 
sector edits were not where they were listed in 
COMPUTIST #53. 1 found them in sector S0E 
instead of sector $09. 

On a side note, the place where I work has 
a big problem with changing to side B on the 
disk. With the protection removed, the disk 
works fine although 1 had to edit my disk for 
"unlimited everything" to find this out. 



Carl D. Purdy 



I have unlocked several pieces of software 
which I would like to share with you at this 
time. These are Milliken math series, copyright 
1980, the Micro-Computer Learning games 
from Learning Well Co., Morning Star Math, 
and Reading Comprehension Main Idea and 
Details from Milton Bradley. 



Milliken Math series 

Milliken 



■ Requirements 

□ Demuffin Plus 

□ A way to break into the monitor 

D DOS 3.3 or a Fast DOS (Pronto DOS from 
Bcaalc Bros.) 



fT~| INIT a blank disk with DOS 3.3 or 
a fast DOS. Have a slave disk handy to save 
the RWTS. 

INIT HELLO 

| 2 | Insert the Milliken disk and boot it. 

PR#6 



| 3 | Break into the monitor and move the 
RWTS to a safe location. 

1900<BSQO.BFFFM 

r 4 I Insert a slave disk and boot it. 
C600G 



| 5 I Insert your Demuffin disk and save 
the Milliken RWTS. 

BSAVE RWTS.MILLIKEN,AS19O0,LS8<I>O 



I 6 I Fiddle with DOS and use 
DEMUFFIN PLUS lo copy some files. 

BLOAD RWTS.MILLIKEN,A$68O0 

CALL - 151 

B8OO<6800.6FFFM 

S03G Starts Demuffin 

From here follow the prompts to save the 
files on the Milliken disk to your INITed disk. 
The files are as follows: 

BOOT 

A . LOGO 

MAT.D 

MANAGER 

CHR SETS YZ 

INIT 

SD. ADDITION (SD. MULTIPLICATION, 

SD. DIVISION, SD. SUBTRACTION) 
B. TEXT POINTERS 
B.TEXT 
ANIMATION 
DIVISION (MULTIPLICATION, DIVISION, 

SUBTRACTION) 
B.ALL9 



| 7 | Once all the files are copied, rename 
the BOOT program "HELLO" and you are 
finished, 

RENAME BOOT,HELLO 



Micro-Computer Learning Games: 

Race Track/Reading for Detail 

Time Capsule/Reading Skills 

Chief oi Detectives/Drawing Conclusions 

Mountain Climbing/Cause & Effect 

School Days/Inference 

Galaxy Search/Predicting Outcomes 

Learning Well Co. 



■ Requirements 

n DOS 3.3 or a Fast DOS (Pronto DOS from 

Beagle Bros.) 
U CopyA 
□ A file copy utility such as Copy II Plus or 

FID 

The Micro-Compmci Learning Games are 
a series of reading games that are really neat 
to use in the classroom, however, I hesitate to 
put originals in the hands of my students. 

Thankfully, it is quite simple to copy these. 

| 1 | Boot your DOS 3.3 system disk 

| 2 | Tell DOS to ignore checksum and 
epilog errors and use COPYA to copy the 
protected disk. 

PORE 47426,24 
RUN COPYA 



fl~| INIT a disk. 



INIT HELLO 



| 4 | Use a copy utility su c h as Copy II Plus 
or FID to copy all of the flics from the COPYA 
disk to your INITed disk. 



| 5 | Determine which File is the boot 
program. It will be something like BOOT, or 
BOOT1. Rename this file to HELLO. 

RENAME BOOT.HELLG 
Softkey for... 



Beading Comprehension 
Main Idea & Details 

Milton Bradley 



■ Requirements 

D A way to break into the monitor 

D DOS 3.3 or a Fast DOS (Pronto DOS from 

Beagle Bros.) 
I J Super IOB and a Swap Contmflcr 
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|~T~| INIT a Blank Disk. 



INIT HELLO 



I 2 | Boot Reading Comprehension , 

[ 3 | Break into the monitor and move the 



RWTS. 
1900<B800.BFFFM 



| 4 ] Boot a slave disk. 
C600G 



|~5~| Save the RWTS. 
BSAVE RWTS.READING,A$1900,L$8OO 



| 6 1 Insert your Super /OB disk. 
LOAD SUPER IOB 
EXEC SWAP.CON 



| 7 | List line 1 00 1 and change it to use 
your RWTS, i.e. RWTS. READING. Place 
slave disk in drive and run Super I0B. 

RUN 



| 8 | Follow the prompts to copy the disk. 
DO NOT rcINIT the disk. 



I 9 I When the copy process is done, boot 

the copied disk and catalog it. Determine which 
program is the boot program and rename it to 
hello. That is all there is to it. 

Softkey for. . . 



Morning Star Spelling 



I 1 I Boot your DOS 3.3 system disk. 

I 2 | Tell DOS to ignore checksum and 
epilog errors and use COPYA to copy the 
protected disk. 

POKE 47426,24 
RUN COPYA 

No other changes arc necessary. 



Stephen J. Scalia 



As my subscription ended last month, I 
thought I might drop you a few lines to tell you 
why 1 did not renew. 

Although 1 am not a novice Apple user, I 
have owned my lie for over four years now, 
I have yet to be able to utilize one softkey or 
feature program from your publication. 

I have typed in almost 200 programs from 
such magazines as "Nibble", 'Compute", 
Tncider" and "A + ". I have gotten all of the 
programs to run and have been able to modify 
them to suit my personal needs, 

"Date/Time Without a Clock Card" by 
Steve Marvin in COMPUTIST #49 is an 
example of the problems I encountered. There 



is absolutely no way a non-assembly language 
programmer could decipher how to make this 
program run. Surely the appropriate changes 
for each version could have been published so 
us BASIC programmers could make use of the 
program. 

I enjoy my Apple and try to subscribe to 
any publication that will broaden my 
knowledge. I must say that after 12 issues of 
COMPUTIST, 1 don't know anymore about 
copy protection than 1 did before I spent the 
S32.00 for the subscription. 

Perhaps you are only interested in writing 
for people with a vast knowledge of assembly 
language but you arc missing a lot of readers 
by not making your publication understandable 
to the 95% of us Apple owners who never will 
own an assembler. 

I'll use my COMPUTIST subscription 
renewal money for something that talks my 
language. "Open-Apple" maybe. 
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Our writers are people just like you. Non- 
professionals who just want to let others know 
what they 've done or something they 've found 
out. Their letters are sometimes short and 
cryptic. But we 're all friends here. If you need 
help with something, all vou have to do is ask. 
RDEXed 



Dr. George Sabeh 



I have enjoyed your publication over the 
past couple years. I have purchased most of the 
available back issues. It has helped me 
understand and enjoy my Apple, I would like 
to contribute two short soltkeys which may help 
some of your readers. 
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Ski Crazed 

Baudvillc 



■ Requirements 

□ Locksmith Fast Copy or a similar copy 

program such as CopyA 
l_l Sector editor 

□ Blank disk 



1 1 1 Copy the original using anv copy 
program, such as Locksmith Fast Copy. 


| 2 | Sector edit the following: 
Trk Set Byte(s) From To 


$00 $04 $A5-A6 D0 F7 

$06 $11-12 D0F7 

$2E-2F D0D5 

$0F $08-09 D0 F7 


EAEA 
EAEA 
EAEA 
EAEA 



disk. 



Make sure you write the sectors back to 



Earth Orbit Stations 

Electronic Arts 



■ Requirements 

."! Locksmith Fast Copy or other copier that 

ignores errors, 
□ Sector editor such as Copy II Phis 
D Blank disk. 



I 1 I Copy the original using Locksmith or 
similar copy program. 



| 2 | Sector edit the following: 
Trk Set Byte(s) From To 



$01 $0A $52-54 


6C 54 00 


18 60 48 


S0F $00-02 


4C 69 A0 


18 60 DD 


S6F-71 


4C 69 A0 


18 60 DO 



Make sure to write the sectors back to disk. 

These two soltkeys would not have been 
possible if it was not for the help gained from 
reading the back issues of COMPUTIST. Keep 
up the good work. 



Name withheld by request 



Advertising Pirate BBS's and 
Encouraging Piracy 

I am a COMPUTIST subscriber and I love 
the new RDEX, and ZOXCOPIES, however, 
COMPUTIST #53 has raised grave concerns. 
On page 37 you printed a letter from Chad 
Baker querying about the new user password 
to a large and infamous Pirate BBS in southern 
California called Motherboard West, Chad also 
advertises another BBS called Alien Nation. 
These boards exist primarily to trade cracked 
copies of software. 

1 hate copy protection and I have become 
an intermediate cracksmith through practice and 
some help from COMPUTIST. I am NOT A 
PIRATE and I fear that if you continue the 
practice of printing this type of letter your 
magazine will suffer from just, legal action from 
the Software Publishers Association. Chad, I 
assume, is a young man and you cannot blame 
him for his ignorance in making this type of 
query. However, I hope you will develop a 
standing editorial policy to prevent future 
incidents. 

By the way , it might be a good idea to give 
Bill Bennett's BBS at 415-349-8245 a few 
words next month. Bill's board is dedicated to 
project STOP, the Software Theft Opposition 
Project. The board functions as a forum where 
interested parties can discuss the software piracy 
issue. Many pirates as well as rep's from 
Electronic Arts and other software publishers 
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arc -currently active on the board. You may also 
write to Project STOP. P.O. Box 3142. San 
Mateo, CA 94403. 

A Tlie problem is that we just don V know 
which Bulletin Board Systems carry what kind 
of information. When it comes to BBSs, we 
aren '! ver\ : active or knowledgable. We just 
print what yon write. Tltis whole magazine is 
just a readers data exchange. It would be 
frivolous for the SPA to pursue us on that issue. 
(No pun intended.) RDEXed 



Leh-Wen Yau 



Hgs Softkey for.. 



Marble Madness 

Electronic Arts 



I purchased Electronic Arts' llgs version 
of Marble Madness a few days ago. It is, of 
course, copy -protected . However, I came up 
with the following steps to make it bypass the 
copy -protect ion scheme: 

CALL-151 

RENAME DOS8.SYSTEM.DOS8.SYS 

BLOAD D0S8.SYSJSYS 

2083: EA EA EA BO 

CREATE D0S8.SYSTEMJSYS 

BSAVE DOS8.SYSTEM,TSY5,A$2000,L7Q54 

This in effect nullifies the instruction "JSR 
$3700". which performs the copy -protect ion 
detection. 

The unprotected game, however, is not 

hard-disk installable due to its hard-coding of 
the volume name /MusicGs. 



(INK, Sask, Canada 
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The American Challenge 

Mind scape 



■ Requirements 

H Apple II/64K 

H COPYA or Disk Muncher (DM) 

□ Blank Disk 

D Sector Editor 



Trk Set Byte(s) 


From 


$00 $00 $2C 


4C00 


That's it. 





To 



4A 



4C D6 43 



Greg Foulos 



Softkey for... 



Sub Mission 

Mind scape 



Sub Mission, by Tom Snyder Productions 
(distributed by Mindscapc) is not copyablc with 
a fast copier. So I loaded, COPYA and 
modified it so it would ignore some data marks. 
The Sub Mission disk was copied into a normal 
format. 

Then I booted my modified COPYA 
version of Suh Mission. It seemed to boot fine, 
but after the screen says "Game: Approved", 
it would load the screen with your ship, read 
about three tracks and then hang, with the drive 
spinning. Apparently it was looking for a nibble 
count. 

So I opened up my drive and booted it 
again, this time watching what the last three 
tracks that it read were. They were $04, S03, 
and S02 (if my memory serves correctly). Not 
possessing an incredible amount of assembly 
language knowledge, 1 looked around those 
tracks and put a JMP into the monitor ($FF59, 
or 4C 59 FF) in various places where other 
J MPs were. 

What I discovered was that the disk seemed 
to read the tracks backwards, because if I put 
a JMP to the monitor on track $04, the program 
would crash earlier than if I put it on track S02. 

But so far, I still was rather lost. So 1 
searched the disk for hex bytes 89 C0. These are 
used whenever the drive is turned on and are 
good bytes to search for when looking for nibble 
counts. I found a bunch of JSRs on track $05, 
sector SOB. I though 1 that the instructions for 
reading tracks $04, $©3, and $02 were on 
track $05. 1 was right. So I counted down three 
JSRs on track $05, sector SOB (where bytes 
89 C0 were found) and NOPed out the third or 
fourth JSR, booted the disk and — no problem. 
It booted fine, and didn't hang. 

| 1 | Load COPYA from your system 
master. 
LOAD COPYA 



| 1 | Boot your DOS 3,3 system disk. 

|~2~1 Tell DOS to ignore checksum and I 2 I Next, enter the monitor and make 



epilog errors and use COPYA to copy the 
protected disk. 
POKE 47426,24 
RUN COPYA 



| 3 I Make the following sector edit lo the 
copy you just made. 



some changes to the machine language part of 

COPYA so it ignores data and address epilogs, 

read errors, and the third byte of the data 

header. 

CALL-151 

B925:1B 60 

B983:1B 60 



BE48:18 
BBFE;00 
3D0G 
RUN 



| 3 i Follow^ the prompts to copy your 

original Sub Mission disk. 



| 4 | Get out a sector editor and make the 
following changes to track $05, sector SOB of 
your copy. 



Trk Set Byte(s) From 



105 S0B SA6-A8 20 AF 5B 



To 

EA EA EA 



Sub Mission is now fully deprotected. 

if you're interested in changing the title 
pages, you can find them on tracks SOE and 
$ I S with a hi-rcs picture searcher. 



Jack Nissel 



Softkey for... 



Mickey's Space Adventure 

Sierra On-Line 



■ Requirements 

U The original Mickey's Space Adventure 

disks 
J 4 blank disks 
□ Sector editor 
\Z DOS 3.3 sysiem disk 
E COPYA 

The softkey in COMPUTIST #25 had 
several errors in it. One was corrected in 
COMPUTIST #27, but the other was not. Here 
is the softkey with all corrections made. 



| 1 | Boot your DOS 3.3 system disk and 
copy all 4 sides of your original disk. 

RUN COPYA 



| 2 1 When you are finished copying the 
disks, answer N to the '"DO YOU WANT 
ANOTHER COPY? Y/N" prompt. 



| 3 | At ihe Applesoft prompt put disk 1, 
side I of your copy in the drive and enter: 

NEW 

BLOAD MICKEY - CODE 

| 4 | After the file has loaded, enter: 

CALL-151 

4014:EA EA EA 

BSAVE MICKEY - CODE, A$4000,L $260© 

You're done 
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Softkey for... 



Where in Europe is 
Carmen Sandiego 



Broderbund 



■ Requirements 

□ The original disk 

□ A blank slave disk 

□ 2 blank disks 
r COPYA 

r Copy II Plus 

If you arc interested in finding out how I 
deproteeted this title read the following, if not 
skip down to the step-by-stcp. at the end of this 
letter. 

The first thing I did when I got this game 
was to load Copy II Plus and catalog it. On side 
1 , the head banged and then I got a VOLUME 
001 and the usual I/O error. On side 2, it was 
a ProDOS disk with the volume name /S1DE2 
and one file named DATA. 

I decided to try a simple approach. I booted 
my DOS 3.3 system disk, typed POKE 
47426,24, RUN COPYA and tried to copy side 
1 . 1 was somewhat surprised to see ii copy with 
no problems. 

I tried to boot this copy but every time it 
tried to read track $00 it rebooted. 

I loaded Copy II Plus so I could look 
through the sectors and decided to CATALOG 
the disk first. I could not beleive what I saw. 
When I tried to catalog side 1 of the original 
disk and view VOLUME OOL I figured that 
the side was DOS 3.3, but on the copy of side 
I was ProDOS, CS A. SYSTEM, and 25 other 
files, each named for a letter of the alphabet, 
except for the letier Z. 

Since COPYA had INITcd the disk DOS 
3.3, 1 decided to format a disk in ProDOS and 
copy the files from the COPYA copy to my 
ProDOS disk, I was hoping that the only 
protection on the original disk was what 
Broderbund was using to mask this side and 
make it look like DOS 3.3, 



i 



At the disk format level, both DOS 3.3 and 
ProDOS are identical- That is, there are 35 
tracks ($00-34) and each track has 16 sectors 
(S00-0F). Each address block begins with 05 
AA 96 and ends with DEAA. Each data block begins 
with 05 AA AD and ends with DE AA. The 
differences are in the kind of data that is stored 
in each sector. (IE. DOS 3.3 stores it's disk 
usage map and directory on track $11, whereas 
ProDOS starts it 's map and directory on track 
$00.) That is why COPYA can copy both DOS 
3.3 and ProDOS disks. COPYA is a whole- 
disk, sector-level copier. It only sees the sectors 
and doesn 'i pay attention to what kind of data 
is stored in which sectors RDEXed 

After copying the files, I used disk copy 



to copy side 2 of the original disk. 

I booted this copy and I am happy to say 
I played the game alt the way through, three 
times, without any problems. 

I then booted the original disk. After the 
disk read started, the "ProDOS 1.4" screen 
came up. If 1 had done this first, instead of 
trying to catalog it, I would have known side 
1 was ProDOS based. However, if I had known 
it was ProDOS based I would not have tried 
COPYA on it and I would not have deprotected 
it as quickly, if at all. 

| 1 | Boot your DOS 3,3 system disk and 
enter: 

POKE 47426,24 
RUN COPYA 



| 2 | Copy side 1 of your original disk to 

your slave disk. 

| 3 I Load Copy II Plus and format your 
first blank disk ProDOS with the VOLUME 

NAME A. 



|~T~| Use the COPY FILES mode to copy 
all of the files from your slave disk to your 
ProDOS disk. 



| 5 I Use the RENAME mode to change 
the VOLUME name on the ProDOS copy yon 
just made from A to CARMEN. EUROPE 

| 6 | Use the COPY DISK mode to copy 
side 2 of your original disk to your second blank 
disk. 



| 7 | You're now all set to get Carmen back 
to jail . 

Softkey for... 



Dr. Ruth's Computer Game 
of Good Sex 



Avalon Hill 



■ Requirements 

l J The original Dr. Ruth 's Computer Game of 

Good Sex 
D 3 blank disks (1 disk to be used as a slave 

disk) 
D Swap controller 
Q Super IOB vi.5 
H DOS 3.3 system disk 

The softkey in COMPUTIST #49 did not 
work for my disk. After the drive would start 
to read side 1 of my copy a second time I would 
get a DISK ERROR message. 1 made sure that 
my modified HELLO program was typed in 
right, and tried some changes in it, but it didn't 
do any good. [ have had luck in the past by 
using the Swap Controller to deprotect some 
Avalon Hill games so I thought I would give 
it a try. The copy that 1 made would crash into 
the monitor when 1 tried to boot side 1 . Deleting 



line 25 from the HELLO program, as the 
softkey in COMPUTIST #49 said to do, made 
the program run fine. Just to see what would 
happen at the Applesoft prompt. I did the POKE 
that line 25 did before I deleted it and it crashed 
into the monitor just as my copy did before I 
modified the HELLO program, 

| 1 | Boot your DOS 3,3 system disk. 

[~2~| INIT your blank disks HELLO and 
then delete the HELLO program. Label these 
disks 1. 2, and slave. 

INIT HELLO 
DELETE HELLO 



1 3 | Boot the original Dr. Ruth disk and 
after your drive reads the first 3 tracks reset 
into the monitor. 



| 4 [ Move the RWTS to a safe location. 
19Offl<BS0O.BFFFM 



| 5 I Put your slave disk in the drive and 
boot it. 
C600G 

| 6 | At the Applesoft prompt enter: 
BSAVE RWTS.OR.RUTH, A$19QQ, L$SQQ 



| 7 | Install the controller listed below into 
Super IOB and copy side one of the original disk 

to disk number 1 . 

| 8 | When side I is finished copying and 
you arc at the Applesoft prompt, turn your 
original disk to side 2, take out disk number 
1 and put in disk number 2, type RUN and press 
return to restart the controller to copy side 2. 

| 9 | When asked, press N, so as not to 
format either disk 1 or 2 while running the 
controller. 

| 10 | Boot disk 1 of your copy a nd when 
you get the Applesoft prompt, press I RESET | 
to stop the boot and enter the following: 

UNLOCK HELLO 
LOAD HELLO 



| 11 | After the HELLO program has 
loaded, enter the following: 

25 

SAVE HELLO 

LOCK HELLO 

Controller 

1000 REM DR. RUTH CONTROLLER 

1010TK = 3:ST = 0:LT = 35:CD = m 

1020 Tl = TK : GOSUB 490 : G0SUB360 ; ONERR GOTO 550 

1030 GOSUB 430 : GOSUB 100 : ST = ST + 1 : I F ST < DOS 

THEN 1030 
1040 I FBF THEN 1060 

1050ST = 0:TK = TK+1: 1FTK< LT THEN 1030 
1060 GOSUB 490 : TK = Tl : ST - : GOSUB 360 
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1070 GOSUB430: GOSUB 100. ST = ST-: 
THEN 1070 



I F ST < DOS 



1080 ST = 0:TK = TK- 1: I F BF = AND TK < LT THEN 
1070 



1090 IF TK < LT THEN 1020 

1100 HOME : PRINT "COPY' DONE" 



END 



10010 I F PEEK (6400) < > 162 THEN PRINT CHRS (4) 
" BLOAO" RI'VTS . OR . RUTH . A51900" 

Checksums 



1000 - I356B 

1010 - $3565 

1020 - JE1E8 

1030 - JF7E9 

1040 - SD35A 

1050 - SEB5B 



1060 - $90D8 

1070 - S98DD 

1080 - $7422 

1090 - S2DB2 

1100 - $1A55 

10010 - JBF60 



Les Minaher 



Creatures of Might & Magic 



The monster data in Might and Magic is 
contained on track SI 2, sector $07 to [rack S13, 
sector SOF. There arc up to 8 monsters per 
sector. Unlike the character data, the monster 
data is stored in a standard, repeating manner. 
The data for the last monster on each sector. 
however, overflows onto the next sector. 
Assuming that the authors of Might and Magic 
wanted to maximize the disk usage, each 
monster is represented by 32 bytes. I haven't 
discovered what all the data is and it is unlikely 
that I will . However, I have learned what some 
of the data represents. 

The information starts in exactly the same 
relative position for each sector. This table gives 
those starting positions and what some of the 
other locations are for. The number in 
parenthesis is the number of bytes used by that 
characteristic. This table is for all but the very 
first, in that sector, the data is still in the same 
format but the beginning of it is slightly 
advanced. The first monster (Flesh Eater) starts 
as if it was monster #5. The last monster on 
the disk is Lord Archer and there is no more 
monster data after it. 



Monster* 

Maine {S0F) 

Speed ($01) 

#of attacks ($01) 
Max damage ($01 ) . 



12 3 4 5 6 7 8 

0C 2C 4C 6C 8C AC CC EC 

21 41 61 81 Al CI El 01 

20 40 60 80 A0 C0 E0 00 

IF 3F 5F 7F 9F BF DF FF 



Armour class ($01) IE 3E 5E 7E 9E BE DE FE 



Here arc the 

I have been able 
monster. 

Monster name 

12-Headed Hydra 
16-Headed Hydra 
5-Headed Hydra 
8-Headed Hydra 
Acidic Blob 
Ai r Elemental 
Algae Beast 
A I ien 
Arch Dev i I 
Arch Dru id 
Arch Mage 
Assas in 
Bas i I i sk 
Banshee 
Barbar ian 
Barbar i an Chief 
Barracuda 
Battle Rat 
Black Dragon 
Black Knight 
Blue Dragon 
Caryat id Guard 
Cave Giani 
Cave Trol I 
Celest ial Stag 
Centaur 
Chaotic Knight 
Chimera 
Cleric 
Cockatrice 
Crocodi le 
Cyclops 
Dark Rider 
Dead iy Spores 
Demon Dog 
Demon King 
Demon Lore 
Diamond Golem 
Dino Beet le 
Dino Lizard 
Dinosaur 
Druid 

Dung Beet le 
Dust Demon 
Earth Elemental 
Electric Eel 
Enchantress 
Evi I Eye 
Execut i oner 
Fi re Ant 
Fi re Beetle 
Fi re Elemental 
Fi re Lizard 
Flesh Eater 
Frost Giant 
Gargantu Ant 
Gargoyle 
Ghost 
Ghoul 

Giant Cent ipede 
Giant Crab 
Giant Leech 



individual characteristics that 
to figure out so far for each 

Armour 
Speed Attacks Damage Cass 



16 
12 
12 
13 
8 
20 
1 

15 
14 
16 
25 
19 
14 
12 
15 
18 
16 
12 
16 
20 
13 
15 
10 
10 
19 
12 
16 
14 
12 
8 

12 
19 
14 
10 
14 
35 
14 
12 
8 

12 
6 

14 
8 

15 
18 
15 
15 
10 
14 
7 
6 

20 
12 
7 

12 
9 
12 
10 
13 
9 

12 
3 



12 10 10 

16 12 15 

5 8 7 
4 8 10 
2 8 1 
1 15 7 

1 5 

2 20 15 

1 100 16 

2 8 10 
2 8 12 
1 6 4 
1 15 5 

1 10 10 

2 12 8 

3 12 10 
1 20 5 
1 3 3 
3 IS 12 
3 50 10 
3 10 8 
1 10 5 
3 16 10 
3 11 7 

3 10 14 

4 4 4 
3 15 14 

6 5 8 
1 8 5 

1 8 4 

2 10 5 
2 15 6 
A 50 15 

1 1 2 

2 10 3 

5 50 30 

2 50 20 

3 60 15 
1 50 10 
1 10 5 

1 200 10 

2 8 4 
1 8 6 

3 10 9 
1 20 8 

1 8 5 
24 6 6 

2 10 10 

2 12 8 
1 6 5 
1 15 7 
1 30 9 

3 10 7 
1 6 2 
1 24 10 
1 12 8 

4 4 5 

1 10 10 
3 5 4 
8 4 5 

2 10 9 
1 8 2 



Giant Scorpion 


13 


3 


8 


7 


Giant Sloth 


14 


4 


8 


5 


Giant Spider 


18 


1 


8 


5 


Giant Squid 


14 


8 


6 


5 


Gnoll 


10 


1 


8 


5 


Gnome 


10 


1 


6 


5 


Gobi in 


10 


1 


6 


4 


Gold Dragon 


16 


5 


20 


10 


Gorgon 


12 


1 


12 


8 


Gray Dragon 


16 


3 


15 


8 


Gray M i notaur 


20 


A 


30 


13 


Great Sea Beast 


30 


1 


100 


12 


Greater Demon 


19 


7 


8 


15 


Greater Devi I 


19 


A 


15 


12 


Green Dragon 


12 


3 


8 


8 


G r em 1 in 


4 


2 


3 


3 


Griffin 


14 


3 


8 


7 


Guardian Spirit 


16 


6 


6 


8 


Guardsman 


14 


1 


6 


2 


Hag 


8 


2 


4 


1 


Harpy 


15 


3 


5 


3 


High Cleric 


18 


3 


16 


14 


Hill Troll 


11 


3 


12 


a 


Hippocampus 


18 


4 


10 


12 


Hippogr i f ' 


14 


3 


8 


5 


Invisible Thing 


25 


3 


10 


14 


Killer Bees 


16 


10 


2 


10 


K i r i n 


22 


4 


40 


15 


Kobold 


6 


1 


4 


4 


Lamprey 


15 


1 


3 


2 


Lava Beast 


9 


2 


.12 


5 


Lesser Demon 


16 


4 


8 


10 


Lesser Dev i 1 


15 


5 


6 


8 


Li ch 


20 


2 


10 


10 


Locust Plague 


17 


10 


1 


5 


Lord Archer 


21 


3 


80 


15 


Mage 


20 


3 


6 


10 


Mag i c i an 


15 


1 


8 


5 


Man Eat mg Mare 


14 


3 


8 


6 


Man! icore 


12 


4 


6 


6 


Mant i s Warr lor 


16 


4 


12 


a 


Master Archer 


18 


8 


16 


10 


Master Thief 


20 


2 


8 


12 


Medusa 


9 


1 


4 


5 


Mi 1 it iaman 


9 


2 


10 


9 


Minor Demon 


16 


2 


8 


5 


Minor Devi 1 


15 


2 


4 


4 


Minotaur 


15 


1 


35 


7 


Mummy 


7 


2 


20 


7 


Mutant Larva 


2 


1 


3 




Naga 


15 


1 


8 


a 


Nat i ves 


10 


2 


6 




Necromancer 


17 


2 


8 


7 


Ogre 


12 


2 


10 


7 


Ogre Chief 


15 


2 


15 


9 


Ore 


12 


1 


8 


5 


Ore Chieftain 


15 


2 


12 


10 


Ore Leader 


14 


1 


a 


5 


Panthro Mist 


18 


4 


8 


7 


Paul Pead 


19 


1 


30 


10 


Pegasus 


20 


3 


8 


4 


Phantom 


10 


2 


8 


7 


Phoeni x 


24 


3 


S 


13 


Pi rate 


17 


1 


20 


8 


Pi rate Captain 


18 


3 


20 


10 


Pol tergiest 


16 


2 


2 
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Pyro Hydra 

Rabid Jackal 

Rabid Leper 

Rakshasha 

Red Dragon 

Rhino Beet le 

Roc 

Rotting Corpse 

Sand Worm 

Satyr 

Savage Shrew 

Scorpion 

Sea Dragon 

Sea Hag 

Sea Serpent 

Shadow Beast 

Shark 

Si I ver Dragon 

Siren 

Skeleton 

SI ither Beast 

Snake 

Specter 

Sphinx 

Sprite 

Steel Golem 

Stone Giant 

Stone Golem 

Storm Gi ant 

Strang! ing Vine 

Sucubus Queen 

Swarming Wasps 

Swordsman 

Thiet 

Titan 

Troglodyte 

Troll 

Unicorn 

Vamp i re 

Vampi re Bat 

Volcano God 

War lock 

Warrior 

Warrior Cat 

Water Elemental 

Water Rat 

Werebear 

Werephase Mummy 

Werewolf 

White Dragon 

White Wo If 

Wicked Wi ich 

Wight 

Wild Boar 

Winged Beast 

Wizard 

Wolverine 

Wood Go I em 

Wraith 

Wyvern 

XXIXXIXXIXXIXX 

Yftti 

Zombie 



12 
15 
11 
14 
15 

7 
14 

3 

8 

10 
13 
20 
32 
1? 
20 
18 
24 
16 
13 

9 

10 
17 
12 
18 
20 
10 
12 

6 
14 

6 

20 
17 
18 
16 
30 
11 
12 
22 
14 
14 
32 
16 
14 
17 
14 

6 

14 
35 
14 
15 
14 
14 
12 
14 
14 
18 
12 

5 

9 
12 
18 
13 

2 



5 
1 
1 
3 
3 
1 
3 
2 
1 
2 
3 
2 
4 
3 
1 
1 
2 
4 
2 
1 
1 
1 
1 
3 
1 
2 
4 
1 
2 
4 
3 

10 
2 
1 
2 
3 
3 
3 
2 
1 
6 
1 
2 
4 
1 
1 
4 
2 
2 
3 
3 
2 
1 
1 
1 
2 
3 
2 
2 
2 
1 
2 



2 
3 
5 

20 

20 

50 

4 

200 

8 

5 

60 

50 

6 

100 

5 

14 
16 



3 

12 
10 

2 

25 
10 
40 
30 

3 
30 

2 
10 

8 
60 

4 

9 

10 
12 

3 



20 
8 

12 
2 
6 

10 

12 

120 

6 

5 

15 
6 

18 
1 

10 



7 
3 

14 

12 

7 

10 
2 
7 
5 
3 

i2 

15 

8 

.10 

3 

6 



3 
4 
2 
8 

11 

10 

15 

10 

7 

9 

3 

20 
4 
6 
3 

13 
5 
6 
8 
9 
2 
30 
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Sofikey fur. 



12 12 

6 6 

50 12 

6 1 



20 
7 
8 

10 
4 
6 
3 

12 
8 
5 
5 
6 
1 

20 
4 
2 



Rings ofZilfin 
Roadwar2000 



SSI 



■ Requirements 

I " Super JOB vl.S 

L Roadwar 2000 and/or Rings of Zilfin 
\Z A sector editor (optional for APT's) 
C A couple blank disks 

The Scheme 

Being the game enthusiast I am, I had gone 
out and bought myself a couple of good 
adventure games. I sat down to play Rings of 
Zilfin first. After two hours of frustrating 
deaths. I decided to try my luck at deprotecting 
it. 

After booting up my Copy II Plus v5.5, I 
snooped around using the sector editor. After 
examining some tracks, 1 found that the even 
tracks would read in with normal parameters, 
while the odd tracks would not. 1 tried getting 
rid of the checksums, but to no avail. This 
forced me to get my nibble copier out and get 
a raw dump. Looking around on track $01, I 
found that the address prologue was changed 
from D5 AA 96 to D4 AA 96 . Nothing else seemed 
to be different, so 1 wrote this down and tried 
it on my sector editor. To my suprisc, it read 
in beautifully and I tried it on the rest of the 
odd tracks. Every one read in and I knew it was 
time to make a controller. 

With the controller installed. I booted up 
my fresh backup and found it worked fine! 
Seeing this, I put it away and started playing 
Road war 2000 . The same thing happened, my 
guys kept getting burnt by the sadists and never 
got anywhere. With a sigh, I got my Super IOB 
out and jokingly tried my Rings of Zilfin 
controller on it. My laughter subsided as it 
started to read and write it accordingly. With 
disbelief, 1 watched it do the entire disk, I tried 
to boot up the copy of Roadwar and again, it 
worked just like the original. Realizing my luck, 
I quickly renamed my controller and set about 
finding some APT's. 

The Procedure 

All you need to do is type in the controller 
at the end of this article and install it in Super 
IOB. Be sure to format your blank disk and 
write protect your backup of Roadwar 2000 . 
The other sides of Rings ofZilfin are already 
copyable, and may I add, contain some 
interesting information. You may also want to 



delete the first two lines of the hello program 
and move all of the files to a Pronto-DOS disk. 
This would let you break out of the program 
whenever you want and load the files in a 
fraction of the time. 

Controller 

1000 REM ROADWAR 2000 & RINGS OF Zl LF IN 

1010TK = 0:ST = 0:LT = 35:CD = WR 

1020 Tl = TK: GOSUB 490; POKE 47405.24: POKE 

47406,95: POKE 47497,24: POKE 47498.96 
1030 POKE 47445. 21 3: IFTK/2<> INT (TK / 2} 

THEN POKE 47445.212 
1040 GOSUB430: GOSUB 100:ST = ST+1: I F ST < DOS 

THEN 1040 
1050 I F BF THEN 1080 
1060ST = 0:TK = TJU1:JK = 212: IFTK/2= INT 

(TK/ 2) THEN JK = 213 
1070 POKE 47445 . JK: I F TK < LT THEN 1030 
1080 GOSUB 490 :TK = Tl :ST = 0: GOSUB 230 
1090 RESTORE 
1100 POKE 47405,208: POKE 47406,19. POKE 

47497,208: POKE 47498, 183 
11 10 GOSUB 430: GOSUB 100:ST = ST + 1: IFST<D0S 

THEN 1110 
1120ST = 0:TK = TK + 1: IF BF = 0ANDTK< LTTHEN 

1110 
1130 IFTK< LTTHEN 1020 
1140 NORMAL ; TEXT : HOME : PRINT "DONE'WITH 1 

COPY" : END 

Checksums 



1000 


- $356B 


1080 


- $8BBC 


1010 


- J3266 


1090 


- $B829 


1020 


- $2F76 


1100 


- $A4E3 


1030 


- $659E 


1110 


- $9AE2 


1040 


- $7598 


1120 


- $4176 


1050 


- SE19B 


1130 


- (6BB7 


1060 


- SB8A7 


1140 


- I20B5 


1070 


- $6024 







A.P.T.for. 



Roadwar 2000 

SSI 



I immediately noticed that this was not 
normal DOS. It used a late version of RDOS, 
which is a pain to sort out (there is a company 
that puts out a program which removes the 
RDOS protection), so I contented myself with 
finding out where my gang information was 
stored. 1 saved my character on a save disk 1 
had just made, and turned off my game. Using 
my sector editor to snoop around my save disk 
1 came across my gang's name. I wrote down 
the sector it was on, track $03. sector SOB, 
loaded up my gang stats and wrote them all 
down. I then went back to that sector and 
searched where everything was placed. I found 
almost everything, but discovered it wasn't 
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enough to make a program out of. Anyway, 
here is the information I found on track SO 3, 
sector $0B. 



Name of gang 


$23-26 


Food 


$39-3A 


Tires 


$3B-3C 


Fuel 


$3D-3E 


Ammo 


$3F-40 


Guns 


$41-42 


edical supplies 


$53 



Here is the information for the first car. 
The information for the rest of the cars follows 
in the same order. 



Type of car 


$64 (see chart) 


Structure 


$66-67 


Mamieverabilitv 


$68-69 


Braking 


$6A 


Acceleration 


$6B 


Protection (L/R/F/B/T) 


$72-76 


Int. crew quality 


$80-84 


Top. erew capacity 


$85 


Top. crew quality 


$86-8A 


Speed 


$91-92 



Chart of vehicles 



Type 


Byte 


Motorcycle 


$00 


Sidecar 


$01 


Compact Conv. 


$02 


Compact H.T. 


$03 


Midsize Conv. 


$04 


Midsize H.T. 


$05 


Sports Car Conv. 


$06 


Sports Car H.T. 


S07 


Station Wagon 


$08 


Limousine 


$09 


Van 


S0A 


Pickup Truck 


SOB 


Offroad Conv. 


SOC 


Offroad H.T. 


SOD 


Bus 


SOE 


Tractor 


$OF 


Construction Veh. 


S10 


Flatbed Truck 


Sll 


Trailer Truck 


S12 


A.P.T. for... 




Rings ofZHfin 


SSI 





I found on the second disk side that there 
was a file called "SA" . This tiny file contained 
all of the information about my man. I wrote 
down some of my man's information and found 
all of it contained in different places in this file. 
I quickly constructed a program that loads your 
player file. It then asks you to confirm changes 
to your character. It edits every aspect of your 
character and saves it to disk. The place you 



are is also contained in this file for whom it may 
concern. 

10 REM * 

11 REM * RINGS OF ZILFIN 
15 REM * EDITOR - BY 

17 REM* AARON SCHOEFFLER 

18 REM * 

19 DC = 1 :DS = CHRS (4) : TEXT : HOME 

20 T I S = " R I NGS 1 OF 1 Z I L F I N' CHARACTER' ED I TOR " 
30 PRINT SPC( (40- ( LEN (Til))) /2);TIS 

40 POKE 34 ,2 

50 VTAB 10: PRINT " PLEASE' INSERT 1 SIDE 1 " ; : 

INVERSE : PR I NT "TWO" ; : NORMAL : PRINT "'OF 1 

RINGS - ' 
60 PRINT "OF 1 7.ILFIN.' PRESS 1 ANY 1 KEY 1 TO 1 

CONTINUED" ;: GET AS 
65 PRINT AS 

70 PRINT DS"BLOAD'SA" 
80 HOME 
90 VTAB 5: PRINT "CHANGE 5 NAME?' {Y/N)*" :: GET 

A$: I F AS = "Y" THEN GOTO 110 
100 GOTO 160 
110HTAB 1: VTAB 7: PRINT "ENTER 1 FOUR 'LETTERS 1 

115 NAMES = "" 

120 NAME$ = "'" : FOR Y = TO 3 : HTAB22 + Y: VTAB 

7 : GET AS : PR I NT A$ : NAMES = NAMES + AS : NEXT 
140VTAB 10: PRINT "ARE'YOU'SUREJ'fY/N) 1 " , . GET 

E$: IF EI < > "Y" THEN GOTO 120 
150 FOR DC = 1 TO LEN (NAMES) : POKE 16497 + DC. 

ASC ( MIDI (NAMES, DC. 1)): NEXT 
160 HOME : VTAB 15: PRINT "*' FATIGUE, 1 

ENDURANCE. 1 MAG. 1 SKILL." : PRINT "SWRD 1 

SKILL/STRENGTH" 
165 VTAB 5: PRINT "CHANGE'ALL 1 SKI LLS'TO 1 9999 ^ 

(Y/N) 1 " ; : GET AS 
167 PRINT AS 

170 IFA$<> "Y" THEN GOTO 200 
180 VTAB 7: PRINT "ARE'YOU'SJREr (Y/N)'" ; : GET 

A$: IFAS< > "Y" THEN GOTO 160 
190 FOR I = 1 TO 2 : POKE 16385+ 1 ,99: NEXT I : FOR 

I = 1 TO 2 : POKE 16388+ 1.99: NEXT : FOR I 

= t TO 2 : POKE 16390 + 1 ,99: NEXT : FOR I = 

1T02: FOR I = 1T02: POKE 16397+ 1 .99: NEXT 

i : FOR I = 1T0 2: POKE 16401+ 1 .99: NEXT I : 

FOR I - 1 TO 2 : POKE 16393 - 1,99: NEXT 
200 HOME : VTAB 5: PRINT " CHANGE' 8 1 PLANTS 1 TO' 

9999HY/N)" ; : GET AS : PRINT AS: IFA$< 

> "Y" THEN GOTO 230 
210 VTAB 7: PRINT "ARE'YOU'SUREHY/N) 1 " ; : GET 

AS: PRINT AS: IFASo "Y" THEN GOTO 200 
220 FOR I = 1 TO 16: POKE 16411 + 1 ,99: NEXT I 
230 HOME : VTAB 5: PRINT "CHANGE'FOOD'TO'9999?' 

{Y/N)'" ;: GET AS: PRINT AS: IFAS< > "Y" 

THEN GOTO 260 
240 VTAB 7: PRINT "ARE'YOU'SURE?^ Y/N) 1 " ; : GET 

AS: PRINT AS: IFASo "Y" THEN GOTO 230 
250 FOR I = 1 TO 2 : POKE 16391 + 1,99: NEXT 
260 HOME : VTAB 5: PRINT "CHANGE'GOLD i TO i 9999 ?a 

(Y/N) 1 " ;: GET AS: PRINT AS: IF AS < > "Y" 

THEN GOTO 300 
270VTAB7:PRINT"ARE 1 YOU'SURE?'(Y/N) 1 " ; : GET 

AS: PRINT AS: IFASo "Y" THEN GOTO 260 



280 FOR I = 1 TO 2: POKE 16387 + 1,99: NEXT 

290 HOME 

300 HOME : VTAB 5: PRINT " CHANGE 1 ALL 1 1 TEMS'TO 1 

99?'(Y/M) i " ;: GET AS: PRINT AS: IFASo 

"Y" THEN GOTO 350 
310 VTAB 7: PRINT "ARE'YOU'SURE' 1 (Y/N) 1 " ; : GET 

A$: PRINT A$: IFA$< > "Y" THEN GOTO 300 
320 FOR I = 1 TO 27: POKE 16428 + 1 ,99: NEXT 
330 HOME 
340 HOME 
350 HOME : VTAB 5; PRINT "CHANGE' BOW? 1 (Y/N)" 1 

:: GET AS: PRINT AJ: IFAS< > "Y" THEN 

GOTO 410 
360VTAB7:PRINT"ARE'YOU 1 SURE?'{Y/N)"' : : GET 

AS: PRINT AS: IFA$< > "Y" THEN GOTO 350 
370 HOME : VTAB 7: PRINT "A' -'ASH 1 BOW" : PRINT 

"B'-'BROM'BOW" : PRINT . PRINT "PICK'ONE: 1 

"::GETAS: IFASo "A" AND AS < > "B" 

THEN PRINT CHRS (7): GOTO 370 
380 IF AS = ,, A" THEN POKE 15408. 18 
390 I F A$ = "B" THEN POKE 16408.19 
400 POKE 16409.99 
410 HOME : VTAB 5: PRINT "CHANGE'SWORDHY/N) 1 

" ;: GET AS: PRINT A$: IFAS< > "Y" THEN 

GOTO 500 
420 VTAB 7: PRINT "ARE'VOU'SURE ?' (Y/N) ' " : : GET 

AS: PRINT A$: IFAS< > "Y" THEN GOTO 410 
430 HOME : VTAB 7: PRINT "A'-'SHORT'SWORD" : 

PRINT "B' -' PELA 1 SWORD" : PRINT "C 1 -' 

SLICER" : PRINT "D^'SLAYER" : PRINT "E"-* 

GRANDSWORD" 
440 VTAB 13: PRINT "PICK'ONE 1 - 1 ":: GET AS: PRINT 

AS: IFAS< > "A" AND AS < > "B" AND AS 

< > "C" AND AS < > "D" AND AS < > "E" 

THEN PRINT CHRS (7): GOTO 430 



450 IFA$ = 


"A' 


THEN POKE 16406 


13 


455 IF AS = 


"B' 


THEN POKE 16406 


14 


460 IF A$ = 


"C 


THEN POKE 16406 


15 


465 IFA$ = 


„ D , 


THEN POKE 16406 


16 


470 IFAS = 


"F 


THEN POKE 16406 


17 



480 POKE 16407,0 

500 HOME : VTAB5: PRINT "CHANGE 1 ARMOUR?' (Y/N)' 

" ;: GETA$: PRINT AS: IFAI< > "Y" THEN 

GOTO 600 
510 VTAB 7: PRINT "ARE'YOU 1 SURE? 1 {Y/N) 1 " ; : GET 

AS: PRINT AI: IFAI< > "Y" THEN GOTO 500 
520 HOME : VTAB 7: PRINT "A'-'LlGHT' ARMOUR" : 

PRINT "B 1 -'MEDIUM' ARMOUR" : PRINT "C'-° 

HEAVY 1 ARMOUR" 
530 VTAB 11: PRINT "PICK'ONE 1 - 1 " ;:GETAS: PRINT 

AS: IFAS< > "A" AND AS < > "B" AND AS 

< > "C" THEN PRINT CHRS (7): GOTO 530 
540 I F AS = "A" THEN POKE 16404,20: 
550 I F AS = "B" THEN POKE 16404 , 21 
560 I F AS = "C" THEN POKE 16404, 22 
570 POKE 16405,99 
600 HOME 
610 VTAB 5 : PR INT "CHANGE^'OF'ARROWS'TO^gg?' 

(Y/N) 1 " ,:GETAJ: PRINT AI: IFAS< > "Y" 

THEN GOTO 700 
620 VTAB 7: PRINr'ARE'YOU'SUREHY/N) 1 " ; : GET 

AS: PRINT AS: IFASo "Y" THEN GOTO 610 
630 POKE 16396.99: POKE 16397.99 
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700 HOME : VTAB 5 : PR I NT "PLEASE'RE- 1 NSERT'S I DE' 
" :: INVERSE : PR I NT "TWO" ; : NORMAL : PRINT 
"OF'RINGS" : PRINT "OF'ZILFIN'DISK." : 
PRINT "PRESS'ANY'KEY'TO'CONTINUE^y " 
; : GET A$ 

705 PRINT A$ 

710 PRINT Dl "BSAVE J SA,AS4000,L$77 -1 

723 TEXT : HOME : PRINT "GOODBYE" : END 



Checksums 


10 


- SBADD 


300 


- SB750 


11 


- SE622 


310 


- SD2CC 


15 


- S1SFA 


320 


- SB024 


17 


- 34046 


330 


- $89C3 


18 


- ICC01 


340 


- J42E3 


19 


- I9A55 


350 


- J090A 


20 


- $7132 


360 


- S60A8 


30 


- $6564 


370 


- S66B3 


40 


- SC087 


380 


- S35E2 


50 


- 577FA 


390 


- $5CCB 


60 


- I2A27 


400 


- $6D07 


65 


- IE448 


410 


- $E446 


70 


- $63D2 


420 


- I539E 


80 


- $5583 


430 


- $4E23 


90 


- $0AC1 


440 


- JF8E4 


100 


- IC15C 


450 


- S56B4 


110 


- ID0AA 


455 


- S2914 


115 


- I955B 


460 


- SD5D1 


120 


- $9180 


465 


- S956F 


140 


- SACF0 


470 


- SC74B 


150 


- $2617 


480 


- S350B 


160 


- $0702 


500 


- 31097 


165 


- $675A 


510 


- $0982 


167 


- $0186 


520 


- S410D 


170 


- I8E99 


530 


- SC1C0 


130 


- $2148 


540 


- $4959 


190 


- S598C 


550 


- I1D15 


200 


- $0032 


560 


- I92BA 


210 


- S17DA 


570 


- J59C1 


220 


- S4A77 


600 


- JFF6A 


230 


- $1364 


510 


- $5C2E 


240 


- S0E7F 


620 


- S74E4 


250 


- S5FF3 


630 


- S6E1A 


260 


- SE7O0 


700 


- S82FE 


270 


- $38B4 


705 


- S0C40 


280 


- $E9C2 


710 


- $9398 


290 


- J9FD6 


720 


- I391B 


' Klaus Iden 



Put your Print Shop graphics 
all on one data disk 

For the many Print Shop enthusiasts who 
have sworn softly to themselves when the 
graphic they wanted could not be found by the 
program because you had the wrong side 
inserted, here's a hint that I've found quite 
useful . 

1 often use the Print Shop and one day 
wondered why Broderbund had not done the 



logical and put all the graphics on one side of 
the Graphics Library Disk. Examining the files 
on a disk revealed that there were a number of 
"show" files that served no purpose oiher than 
for advertisement (and taking up room). These 
could easily be eliminated. But would that leave 
enough room? There were 120 graphics on a 
Graphics Library Disk. Each graphic used four 
seciors. A DOS 3.3 disk was divided into 560 
sectors. Tracks S00-02 were used by DOS and 
track SI I normally consisted of the catalog. 
Since I wanted the graphics disk for data only, 
DOS could be eliminated. That would gain 32 
sectors for data (Tracks $01 and $02). Track 
$00 was not available without extensive 
changes to the Print Shop DOS, so I decided 
to leave it alone. 

Turning to track SI 1 . sector SOO, I found 
this was reserved for the VTOC (Volume Table 
Of Contents) . That left me with 543 sectors for 
data and the catalog. Each graphic occupies four 
sectors and each catalog sector can list seven 
file names. A little arithematic showed that 1 
should be able to get up to 131 graphics files 
onto one side of a disk, however I would need 
19 catalog sectors rather than the 15 regularly 
allocated. 

I recalled an article by Clay Ruth in Call 
-A.P.P.L.E.'s All About DOS. It turned out 
that allocating extra catalog sectors was quite 
simple. linheVTOC(traekSll,sector$0O), 
bytes ) and 2 pointed to the first catalog sector. 
Normally this was track SI 1, sector $0F. If 1 
were to change this to track $12, sector $02, 
then I should have an extra 3 sectors for a total 
of (18 x 7} 126 files, more than I needed. All 
that required doing was to change bytes 1 and 
2 of each of these new catalog sectors starting 
with track 512, sector S02, such that they 
would each point to the next lower catalog 
sector. 



Trk Set Byte(s) From 

S12 S02 S01-02 1 

S12 S01 S01-02 t 

S12 S00 S01-02 ? 



To 



12 01 
12 00 
11 0F 



The final step would then be to change the 
VTOC to indicate that tracks $01 and $02 were 
available for data and sectors $00-03 of track 
$12 were not. Checking through my well worn 
Beneath Apple DOS manual, I came up with 
the appropriate changes. 



Trk Set Byte(s) From 

$7l $00 $3C 
$3D 
$40 
$41 
$81 



$02 



To 

fT 

FF 

FF 
FF 

12 

02 



I booted up my sector editor and went to 
work. So far so good. I could CATALOG the 
disk, SAVE and LOAD files. Now for the real 
test, I transferred the graphic files using FID, 
and held my breath as I booted Prim Shop. To 
my delight, the program was able to find all of 
the 120 graphics, although I found that I was 
unable to display them all by using the Print 
Shop CATALOG option. The ones that didn't 
show up were those on track $12. It is possible 
to patch the Prim Shop program to read these 
extra sectors, but more on that later. If you 
initialize the data disk within the Print Shop 
program, you even get a message on track SO©, 
sector SO0 that will tell you that you have a 
data disk that cannot be booted. My final touch 
was to use Beagle Bros. Patent program and 
organize my catalog alphahctically. 

I had to use FID to transfer the files, even 
though it is slow and somewhat inconvenient, 
because I found that Copy II Plus did not like 
the unusual catalog format and would try to 
change it back to normal while transferring 
files, defeating the purpose of the exercise. 

I used a sector editor to make the changes 
to my data disk, then thought, why not do this 
using the Super IOB. So, for those readers 
without access to a sector editor, here's a quick 
way to make your special graphics disk. 

Step By Step 



| 1 | Initialize a new data disk using the 
Print Shop program. 

| 2 | Type in the controller and run Super 
IOB. 



| 3 | When asked how many drives, 
indicate only 1 and insert your newly initialized 
data disk. Use it for the original and target disk. 



| 4 | Transfer the graphics using FID or 
any other file mover you wish (beware of the 
problem with Copy II Plus) 

Controller 



1000 REM PR I NT SHOP GRAPH I CS DATA D I SK MAKER 
1010TK=17:LT = 19:ST = 15:LS=15:CD = WR:FAST 

= 1 
1020 GOSUB 490: GOSUB610 
1030 GOSUB 499 :T1 = TKTK = PEEK (TRK): GOSUB 

31B:TK = T1: GOSUB 610 
1100 HOME : PRI NT "FIN ISHED" : END 
5000 DATA '13'CHANGES 
5010 DATA '17,0.1, 18 
5020 DATA'17, 0,2,2 
5030 DATA '17 ,0, 129. 248, 17, : 60 ,255 
5040 DATA "17,0,61, 255, 17 ,0,64, 255 
5050 DATA "17,0,65.255 
5060 DATA'18, 0,1,17,18,0,2,15 
5070 DATA '18,1. 1,18,18, 1,2,0 
5080 DATA "18 ,2.1 , IS, 13,2. 2, 1 
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Checksums 



1000 - $356B 5020 - $E70B 

1010 - $6A0D 5030 - $50C3 

1020 - SSDFC 5040 - $B092 

1030 - $3CCB 5050 - $A3A0 

1100 - $C526 5060 - SDF93 

5000 - $5336 5070 - $7A50 

5010 - $4E4F 5080 - $6520 



Print Shop Catalog Patch 



■ Requirements 

□ Apple II +, lie or lie 

□ Modified Graphics Library Data Disks 
Q Deprotected Print Shop Program 

The problem I had with Print Shop not 
locating the extra graphics on my modified 
graphics disk led to this patch that I discovered 
after several hours of snooping and head 
scratching. What had caused my original 
confusion was that the graphic files could be 
displayed under DOS with a catalog command. 
So why didn't Print Shop display them? After 
all, the program could load the graphics when 
requested. 

The answer came to me late one evening 
after I had been searching the disk for anything 
that smacked of a catalog routine. Perhaps the 
Print Shop didn't use the DOS catalog routine! 
Perhaps the program used it's own RWTS 
(Read/ Write/Track/ Sector) routine to read in 
the catalog sectors. I searched the disk again, 
this time for 20 D9 03 (JSR $©3D9), a call to the 
RWTS, I found several of these, one in HELLO 
and two in MENUL1B. Examining the second 
call in MENULIB, I came across some 
interesting code starting at $8032: 



8032 LDA 
8035 STA 
8038 STA 
803B LDA 
803D STA 
8040 LDA 
8043 STA 
8046 LDA 
8048 STA 
804B LDA 
804D STA 
8050 LDA 
8052 LDY 
8054 JSR 



$B7F7 

$811F 

$812D 

#$0F 

$8123 

S95F4 

$8120 

#$00 

$8004 



Last slot accessed by DOS 
Store in 108 (present slot) 
Store fn IOB (last slot) 

Store in lOB(sector) 
Seconddrive for datadisk? 
Store in 108 (drive to use) 

Counter for files found 



$81C2 Counter for files displayed 
#$81 hi-byte of 108 address 
#S1E io-byte of 108 address 
$03D9 RWTScall 

The $OF caught my eye. Sector $0F is 
usually the start of the catalog sectors. I quickly 
located an IOB (Input/Ouput Block) at $81 IE. 



An IOB is a table of 17 parameters that are used 
by the RWTS. 

Table type, must be $01 

Slot times 16 (=6) 

Drive = 1 

Volume number expected ($00 

matches any) 

Track s 11 

Sector =0 

OCT (Device Characteristics 

Table) LObyte 

OCT HI byte of address = $812F 

Buffer address LObyte 

Buffer address HI byte = $8200 

Not used 

Bytecount ($00 = 256 bytes or 1 

sector) 

Command code ($00 = seek, $01 a 

read, $02 = write, $03 - format) 

Error code ($00 - no error) 

Volume number of last disk acessed 

Slot of last disk acessed 

Drive last acessed 



SHE 


01 


811F 


60 


8120 


01 


8121 


00 


8122 


11 


8123 


00 


8124 


2F 


8125 


81 


8126 


00 


8127 


82 


8128 


00 


8129 


00 



812A 01 

812B 00 

812C 00 

812D 60 

812E 01 



Finally, it became obvious why extra 
sectors were never accessed. When doing a 
catalog under DOS, the VTOC is read and the 
first catalog sector is determined from bytes 1 
and 2. Print Shop never looked at the VTOC 
on a graphics disk. It assumed use of only track 
$11 and starting sector SOF. Code at S80D5 
decremented the sector count, while a value of 
00 at $8201 (sector buffer) indicated the last 
sector thus terminating the routine. 

$8123 Decrement sector 
$8201 Load byte SI of buffer 
$80E8 It =g cost inue reading 
$8004 Load # of files found 
S80EB branch here if = 
$81C2 Load § of files on screen 
$80F4 if = wait for keypress 

Return 
$8050 Continue reading sectors 

The changes needed in order for the 
program to operate as I wanted it to would 
include an initial reading of the VTOC and use 
of bytes 1 and 2 of each sector to point to the 
next directory sector, rather than the 
decrementing routine at S80D5. 

I couldn't add the additional code to the end 
of this file as there wasn't room. The file ends 
at S81F8 and the buffer starts at $8200. I had 
to find unused memory that was not occupied 
by program code, graphics, or used as storage 
areas. I filled memory from $800 to $9AA5 
(HIMEM is $9AA6) with $FF's and started the 
HELLO program. I stopped the program with 
my Wildcard after using all parts of Print Shop 
and examined the memory for possible unused 
areas. 

There wasn't much! However, there 
appeared to be some memory from S98F8 to 



80D5 


DEC 


80D8 


LDA 


80DB 


BNE 


80DD 


LDA 


80E0 


BEQ 


80E2 


LDA 


80E5 


BNE 


80E7 


RTS 


80E8 


JMP 



$9AA5 that looked okay. The second problem 
was how to get my code there. I finally decided 
to alter the HELLO program and append my 
patch and a memory move routine to the end 
of it and have this routine run before any other 
code was executed. I've used this extensively 
and found it to work quite satisfactorily. 

Step By Step 



I 1 I Load HELLO and make some 
changes. 

BLOAD HELLO 

CALL-151 

0800:40 00 10 

1000:A2 20 BD OD 10 9D FF 98 

1008:CA DO F7 4C 34 08 A9 11 

1010:8D 22 81 A9 00 8D 23 81 

1018:A9 81 AO IE 20 D9 03 BO 

1020:0C AD 01 82 8D 22 81 AO 

1028:02 82 BD 23 81 60 00 00 

B8AVE HELLO, A$800, LS82E 

Here is what this code looks like 



0800 


JMP 


$1000 


Jump toourmove routine 


1000 


LDX 


#$20 


Loadftbyies tomove 


1002 


LDA 


$100D,X Load data from here and 


1005 


STA 


$98FF 


store here 


1008 


DEX 




Count down 


1009 


BNE 


$1002 


if <>0then loop back 


100B 


JMP 


$0834 


Back to original program 


100E 


LDA 


#$11 


Initialize 


1010 


STA 


$8122 


IOB 


1013 


LDA 


#$00 


to 


1015 


STA 


$8123 


read 


1018 


LDA 


#$81 


the 


101A 


LDY 


#$1E 


VTOC 


101C 


JSR 


$03D9 


MTSca/l 


101F 


BCS 


$102D 


Branch if error occurred 


1021 


LDA 


$8201 


Load track and 


1024 


STA 


$8122 


store in IOB 


1027 


LDA 


$8202 


Load sector and 


102A 


STA 


$8123 


store in IOB 


102D 


RTS 


ow char 


Return 


1 2 


IN 


ige MENULIB. 



BLOAD MENULIB 
803B:AD F4 95 8D 20 
8040:81 20 00 99 20 13 99 
BSAVE MENULIB, AS6OO0, L$21F8 

Here's what we did. 

8036 LDA $95F4 Get drive # to use 

803E STA $8120 Store in IOB 

8041 JSR mm So to patch and read VTOC, 
then get sector and track 
for first directory sector 

80D5 JSR $9913 Go to patch and get next 
sector to read 

That's it. The program will now catalog 
your Print Shop Graphics disks. 
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Jell Hurlburt 



The 



WBMNNST 



Ratings 



<3<5^H3 SUPERB 

^5^5<!^5 EXCELLENT 

^J^J<2 VERY GOOD 

^3^3 GOOD 

<t FAIR 

® 

®® 

d®® 



POOR 

BAD 

. . DEFECTIVE 



System Saver Ilgs 

Line conditioner/ cooler/ power organizer 
$99,95, from Kensington for Apple Ilgs 

WH3<5 

Were you to take a poll of hardware types 
on the question: "What is the major threat to 
micro-computer health?" it's likely that "line 
glitches" or "over-heating" would account for 
the overwhelming majority of responses. For 
some time Ilgs owners have met these threats 
with line conditioner strips and fan 
installations— 'workable' solutions, which left 
us wishing for some less cumbersome, less 
noisy alternative. Like, ' 'why doesn't someone 
put all that cooling and AC line stuff in a nice, 
compact case?" Finally, someone has!; and the 
result is a product called "System Saver Ilgs'. 

Perfectly matched in color and styling to 
your Ilgs, "System Saver" fits like a glove 
between computer and monitor. It actually looks 
like part of the computer, with the nice side- 
benefit of raising the monitor to a more 
comfortable viewing level. Two slant-mounted 
push-bar switches complete the match, each 
being illuminated by twin green LED's to 
mimic the Ilgs power-on indicator. 

The switches, one labeled "MASTER" 
and the other "AUX", each control two 
grounded power outlets mounted on back of the 
case. "MASTER" switches sockets labeled 
"Computer" and "Monitor" and also turns on 



the fan; "AUX" switches "Printer" and 
"Aux". In case you need to power a plug-in 
transformer (as used with some modems), 
Kensington will supply a short extension cord 
free (!), when you return the warranty card. 

To squelch those nasty power line 
gremlins, you get a hefty LC filter (two 1" 
toroid inductors plus capacitor) with a metal 
oxide varistor ("MOV") surge suppressor 
connected between the AC lines. Similar 
MOV's run from AC 'hot' (black line) and 
'neutral' (white line) to 'ground'. The devices 
appear to be GE V 130L20A equivalent types, 
a good long-life choice for the typical 120 VAC 
installation. Finally, "System Saver" adds a 
back-panel -mounted circuit breaker to protect 
against " ... a particularly large power surge" 
as well as shorts on any of the outputs. Oddly, 
an internal fuse on the between-lines MOV is 
not mentioned in the documentation. If my 
circuit-tracing is accurate, its function is to 
interrupt current flow to the "MASTER" 
LED's to provide a visible indication of possible 
MOV failure. 

Boasting a 10 amp rating, "System Saver" 
can easily handle the power-control /line- 
conditioning chores for your entire system. 
Still, while it rates a solid "good" on this score, 
there is room for improvement. For instance, 
since there is space for five sockets on the back 
panel, there should be five; and protection 
during non-use would be better if both AC lines 
were switched, instead of just 'hot'. As to 
control, I suspect most Ilgs owners would prefer 
that "Computer" have its own switch, with 
"AUX" for monitor, printer, etc. and 
"MASTER" to enable everything. This way, 
a single bar-press could power-up the system; 
and one could turn the computer on and off 
without switching the monitor as well. 

Like many Ilgs types I've put off adding 
the recommended in-case fan. With just 
memory and stereo boards, it hasn't been 
necessary; and I wonder about the cooling 
efficiency of an approach that relies chiefly 
upon blowing air around inside the case while 
taking in relatively little air from the outside. 
In addition to which— let's face it— Apple's 
fan sounds like a mainframe blower! (Whether 
jamming with "Instant Music" or playing 
"Bard's Tale", who needs hurricane sound 
effects?!) "System Saver", on the other hand, 
uses its 3", 17 CFM muffin fan to pull air 
through the top of the computer, QUIETLY 
drawing fresh air through other vents, slot 
openings, etc.. 

In order to get some idea as to whether 
"System Saver" cooling makes any difference, 
1 sampled in-case temperature change with and 
without the unit in place over two two-hour 
periods. Without forced-air cooling, in-case 
temperature rose about 18 degrees vis-a-vis 
outside temperature. With "System Saver" in 
place, the change was only 2 degrees. In a case 



packed with an internal modem, co -processor 
board, and other goodies, this sort of difference 
could be a life-saver for IC's and other 
components whieh must dissipate heat.. The 
lesson seems clear, if you plan to expand your 
Ilgs, something on the order of "System Saver" 
cooling is a necessity. 

Granted, one doesn't invest in "System 
Saver' ' just to provide cooling and de-glitching; 
there are less expensive alternatives. But, if 
you're after good line protection, quiet cooling, 
and a solid boost in operating convenience, all 
in a very classy package, then Kensington's 
' 'System Saver Ilgs' ' is THE way to go. 



Lane Mastodon VS. The Blubbermen \ 

Comic Book 




$12.0© 



Infocom 



<W3 



■ Requires: 

□ 64K Apple II series 

□ one 5 V* " drive 

□ second drive recommended (copy side 2 of 

diskette) 

Perhaps it was inevitable that, barely a year 
after release of the first computer novel 
("Portal"), the first true computer comic book 
would 'hit the stands'. Unlike Accolade's 
"Comics", Infocom's "Infocomics" editions 
are picture-text read-only affairs, not games. 
Once the story begins, you can just sit back and 
watch the story unfold. At the fastest of three 
speed settings, this provides about an hour of 
'reading'. 

"What?!", you gasp, "no 'user 
interaction'?" Fear not. Recognizing that 
computer types are not well disposed to hands- 
off entertainment, Infocom lets you 'rewind', 
'fast-forward', or pause the presentation, and 
insert a bookmark (do a GAME SAVE). Best 
of all is an option to branch the presentation at 
numerous key points. For example, in "Lane 
Mastadon vs. the Blubbermen", a "tattered 
bikini'-clad beauty and her kid brother become 
the companions of our hero on a mission to stop 
the blubbermen of Jupiter from conquering 
earth. Branching options let you stay with Lane 
from start to finish, follow his companions 
when they become separated, and/or take a look 
at things from the blubbermen 's viewpoint. 
Following every branch (recommended) can 
easily double the presentation's duration. 

Granted, any space adventure featuring 
curvacious cuties, evil aliens, and a stalwart 
hero (to say nothing of his elephant-shaped 
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craft, the mighty "Mastadoti") is almost a 
guaranteed winner. But story line is onJy part 
of the Infocomics secret. Employing simple 
animation and fractal techniques, each frame, 
in effect, becomes several, with panned 
scenery, rn-out zooms, fades, etc.. Add sound 
effects and music, PLUS a chance to grom-up 
on "Lane Mastadon" #1 (!), and you have a 
quality, super- comic-book value. 

VENDORS 

Infocom 1 25 Cambridge Park Drive, Cambridge, 
MA 02140 (800-263-6868) 

Kensington Microware 251 Park Avenue 
South, New York, NY 10010(800-535-4242, in 
NY call 212-475-5200) 



Marshall P, Brown 



Softkey for. 



Mind Prober 

Human Edge Software Corporation 



■ Requirements 

D Any copy program 

□ A sector editor 

□ 1 blank disk 

□ An Apple II is useful 

Mind Prober is billed as "innovative expert 
systems software" to "let you see people as 
they really are" and, within the limitations 
imposed by the speed and memory of the Apple 
II series of computers does a surprisingly good 
job. 

The limitations, of any expert system, are 
the skill of the programmer in providing the 
right expertise for the system and his ability to 
have the program ask the right questions. There 
are, of course, a number of other technical 
factors relating to both the software and 
hardware but without the right questions and 
the right expert data base the attempt fails. 

Mind Prober succeeds! It is dreadfully 
slow, spends forever in disk reads and only has 
a limited data base, but on the whole is a good 
example of an expert system in action. 

It goes without saying that it is protected. 
Any standard disk copy utility will copy it, it 
just won't run. Being a relatively sane person, 
I found this unacceptable. 

The softkey for Mind Prober is simple to 
implement, consisting of a disk edit of a single 
byte and, as is often the case, was found only 
after long hours of looking and a little luck. 

Since the disk looked so standard, I started 
with Locksmith 's Fastcopy to make my work 
disk. 

The next step was to boot my favorite 
utility. Locksmith 6.0' a auto boot code tracer. 



For those of you who haven't used this utility, 
I can only say it is worth the price of the entire 
disk. It is as close to a full blown 6502-65CO2 
emulator as I have ever seen. It won't read all 
protected disks but I am really impressed with 
what it will read and track. 

Step three was to boot the Mind Prober 
work copy using the emulator and then to watch 
for the place where things went wrong with the 
boot. 

After much watching I noticed a stange bit 
of code being executed at $6060. It was only 
called once and didn't spend much time there 
but it did look worth examining in more detail. 
I dropped out of the emulator and listed the 
code. It looked like mostly trash but you never 
know. I jumped back to the emulator and 
instructed it to stop when the program counter 
equaled $6060. 

Rebooting the program from the emulator 
to start everything off right, I sat back and 
waited for the break and then single stepped 
through the code. What do you know, no more 
trash. The program uses conditional jumps to 
skip over sections of bad c ode. The m ost simple 
approach seemed to be a iKETmwl at $6060. 
That was too simple, so I followed through 
again, a step at a time, and found a disk read 
called via some code hidden at $©3D9 which 
JMPs to $B7B5. On the return to $608A, an 
examination is made of the results of the disk 
read. Thi s seemed like a good place for a 
I RETURN] and as they say "the rest is 
history'. 

A search of the disk found the code in a 
file named HUMAN.OBJ. 



I 1 I Make a copy using any standard disk 
copy utility. 

I 2 | Using a disk search utility search for 
A0 01 Bl 10 A8 D0 01 and change the A0 to 60. 



^ 


Michael Javorka t 


Softkey for... 


Xevious 

Mindscape 



■ Requirements 

□ Xevious original disk 

□ 2 blank disk sides 

□ DOS 3.3 System Master 
n A file copier 



I 1 I Boot your DOS 3.3 system disk. 

I 2 | Tell DOS to ignore checksum and 
epilog errors and use COPY A to copy the disk. 
POKE 47426,24 
RUN COPYA 

This procedure will copy the entire disk. 



But when the copy is booted it resets on itself. 
I INITed a disk with ProntoDOS (probably any 
fast DOS will do) and then copied all the files 
from the deprotected disk to this disk. It worked 
perfectly. 



I 3 I Boot up your fast DOS, put your blank 
disk in the drive, then type the following: 
NEW 
MIT HELLO 



I 4 | Use a file copy program to copy all 
the files from the deprotected copy to the fast 
DOS disk. 



Playing Tips for. 



Donkey Kong 

Atari 



My thanks to John Baeuer's and Paul R. 
Wilson for their APT's on extra lives and a 
super Mario for Donkey Kong. I would like to 
add some extra info on super Mario. 

As Paul Wilson stated, by pressing "2" wc 
now have a super Mario. You can have Mario 
become super Mario at any level, not just the 
Elevator level. While on the Elevator level, 
have your super Mario walk on the ground to 
where the springing I beams are falling. If you 
position yourself just right, the I beams will 
push you down through the bottom of the screen 
and you will appear on the top of the screen 
to rescue your sweetheart. If you are pushed 
off the bottom of the screen and don't appear 
at the top, then walk to the left and you should 
drop in on your sweetheart and Kong. 



Lewis J. Shire man 



f Softkey for... 



Dome Simplified Bookkeeping 
System 

Accounting By Computer 



■ Requirements 

D Super IOB modified to read/write every 

other track (COMPUTIST #53) 
□ Copy program to copy DOS 3.3 
D Blank disk 

This is a computerized version of the 
widely used Dome system. I picked up a copy 
at what I considered a reasonable price, until 
I discovered what they were up to in the system. 
The Dome System, like other paper systems of 
it's kind, is built around the idea that you will 
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buy a new set of books each year. Well, their 
program is set up to make you do the same! 

The disk is copy protected, using several 
techinques, but the real catch is that once you 
enter the accounting year, it can't be changed! 
Rather upset at this device, I set out to deprotect 
the disk prior to using any copy. Two of the 
copy protection schemes, once identified, were 
removed by using Bill Jetzer's Modify Super 
IOB to Read/Write Every Other Track in 
COMPUTIST #53. These were altered epilog 
values, and altered address markers on alternate 
tracks (D4 AA 96 instead of 05 AA 96). I used Super 
IOB with Bill's controller for Colonial 
Conquest/Blue Powder, Grey Smoke and it 
worked just fine for removing these problems. 

There was at least one additional problem 
(probably a nibble count) that is removed by 
copying a unmodified DOS from the DOS 3.3 
Master onto the copy. After that, the program 
worked fine. 



I 1 1 INIT a blank disk, preferably with a 



fast DOS. 
INIT LOGO 



Klaus I den 



Softkey for... 



The Factory 

The Pond 

M-ss-ng L-nks 

Sunburst Communications 



■ Requirements 

□ Apple II Plus 
D Super IOB vl.5 

In recent issues, (COMPUTIST #30 and 
#39), methods for softkeying several Sunburst 
software programs were described. These 
depended on either a way to reset into the 
monitor or a machine with 128K. In either case, 
the authors captured the Sunburst RWTS and 
used a swap controller. 

For people without a means of setting into 
the monitor or a lie or lie with only 64K 
memory, there is another way of deprotecting 
these excellent educational programs. My 
method uses a controller that changes the third 
byte of both the address and data headers as 
needed for each track. This is fairly simple 
because these bytes are changed in the same 
sequence as the write translation table found in 
normal DOS 3.3 (5BA29 - $BA68). See 
Beneath Apple DOS, by Don Worth and Pieter 
Lechner, and the two previous articles for more 
information on this subject. 

Tracks $1 1 to S22 are written on half-tracks 
on the originals and are relocated on the 
softkeyed versions. This method will only work 
for DOS 3.3 programs so check the labels. 
Note: Copy II Plus v6.0 will also make good 
backups of the originals. 



[ 2 I Load Super IOB 1.5 and enter the 
following controller. 

Controller 



1000 REM SUNBURST COMHUN I CAT I ONS CONTROLLER 

1010TK = 3:ST = 0:LT = 35:CD = WR 

1020 Tl = TK: GOSUE 490: POKE 47426,24: REM 
IGNORE EPILOGS 

1022 IFTK> 16 THEN CD = 0: GOSUB 100: POKE BUF. 
PEEK (BUF) - 1:CD = RD:PH = TK* 2:S = 1: 
GOSUB 130 : REM READ HALF TRACKS AFTER TRACK 
16 

1030 GOSUB 430: POKE 47466, PEEK (47657 + TK) : 
POKE 47356 , PEEK (47668 + TK) : GOSUB 100 : ST 
= ST + I : I F ST < DOS THEN 1030 : REM CHANGE 
ADDRESS AND DATA PROLOGS EVERY TRACK 

1040 I FBF THEN 1060 

1050 ST = 0:TK = TK + 1 : I F TK < LT THEN 1022 

1060 GOSUB 230 : GOSUB 490:TK = Tl :ST = 

1070GOSUB430: GOSUB 100:ST = ST + 1: I F ST < DOS 
THEN 1070 

I080ST = 0:TK = TK + 1: I F BF = ANDTK< LTTHEN 
1070 

1090 I FTK< LTTHEN 1020 

1100 HOME : PRINT "FINISHED" : END 

Checksums 



- $356B 1050 - $D907 

1010 - $3565 1060 - $6860 

1020 - $B078 1070 - $6065 

1022 - $0823 1080 - $CCAA 

1030 - $ED95 1090 - $F5AA 

1040 - $7992 1100 - J36EF 



MOST 

WANTED 



ABM Muse 

Agent U.S.A. Scholastic 

Airhead Broderbund 

Algeblaster Davidson & Associates 

Algebra I Intelligent Tutor 

Apple Super Pilot 1 

Artificial Intelligence Scholastic 

Balance of Power Minds-cape 

Bandits Sirius Software 

Bank Street Filer Broderbund 

Bank Street School Fder Sunburst Communications 

Barron's Computer SAT ? 

SSI 

Atarisoft 

Brain Bank The Observatory 

Burgertime ? 



Calendar Crafier llgs MECC 

Captain Goodnight 1 

Certificate library Vol. I '! 

Championship Baseball ? 

Chuck Yeagtr's Advanced Flight Trainer Electronic Arts 

Colossus IV Firebird 

Creature Venture Softstnith Co. 

Cross Clues Science Research 

Cross Country Rally Safismith Co. 

Crossword Magic Mindscape 

David's Midnight Magic ? 

DB Master V4.0 Stoneware 

Deathhrd Electronic Arts 

Dome Bookkeeping Systems Dome Accounting 

Fay: The Masked Woman Didatech Software 

Fay's Word Rally Didatech Software 

Fun Bunch Unicom 

Galaxian Atarisoft 

Game Show Advanced Ideas 

Garfield Deluxe Edition DIM 

Gemstone Healer SSI 

GoldFtnger Mindscape 

GradeBusters 1-2-3 Gradebusters 

Gutenburg Jr. Micromotion LTD 

Handicapping System Spans Judge 

J &S Grade Book J&SSofimre 

Jigsaw Microfun 

Joust Atarisoft 

Legacy of the Ancients Electronic Arts 

Little Computer Peoples House on a Disk Activision 

Lollipop Dragon: Cursor Control Adventures Society for Visual Ed 

Lollipop Dragon: Plotting & Programming Adventures Society foi 

Visual Ed 
Lollipop Dragon: Letter & Number Key Adventures Societvfbt 

Visual Ed 

Lollipop Dragon: Function Key Adventures Society for Visual FA 

Magic Spelts The Learning Company 

Maxi Golf 'Ihunder Mountain 

Micro League Baseball Micro-league Sports 

Microtine US Scholastic 

Mr. Do Daiasoft 

Mr. Fuel's Cartoon Kit Mindscape 

Ms. Fuc-Mun Atarisoft 

Never Ending Story Datasoft 

Odin Odesta 

Peeping Tom Microlab 

Pensate Penguin 

Personal Finance Manager (PFM) Apple Computer 

FFS File & Report llgs Software Publishing Corp, 

Pirates Mkroprose Software 

Prime Plotter Frimesoft Corp. 

Principals Assistant Library Mindscape 

Print Master Unision World 

Fro-Footindl Sports Judge 

Publisher Springboard 

Fades & Fosters MECC 

Quiz Castle Didatech Software 

Rescue On Fractdis Epyx 

Ruski Duck Softsmith Co, 

Scrabble Electronic Arts 

Snaggle Broderbund 

Space Eggs Sims 

Space Journey Mindscape 

Stellar 7 Penguin Software 

Success with Typing vl.2 Scholastic Software 

Super Factory Sunburst 

Think Tank Living Video 

Tower of Myragkn II (llgs) ? 

Toy Stop Broderbund 

Ultima V Origin Systems 

Universe Omnitrend 
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COMPUTIST back issues 



To order. Use the back issue order form on page 42 



June 1988 * MFeatures: • Apple llgs 
Secret Weapon *5 Second Fastboot into Locksmith 6.0 
Fastcopy *The Product Monitor "Taking the grind out 
of Championship Wrestling 'Making some improvements 
toTheNibbler tSoftkeys: «24O0 AD '40' Graphics 
Studio 'Accolade Comics 'Aesop's Fables 'American 
People 'Animal Hotel 'Applewriter lie 'Arcade Album 
# I 'Arctic Antics 'Ballblazer 'Bard's Tale II: The Destiny 
Knight 'Bard's Tale llgs 'Cat'n Mouse 'Championship 
Wrestling 'Charlie Brown's 1,2,3's 'Cobra Cavern 
•Color Me 'Create With Garfield 'David Winfieid's 
Batter Up! 'Destroyer 'Disk Optimizer II 'Dragonworld 
•Electronic Arts Software 'En Vacances *En Ville 
•Famavision gs 'Fight Night 'Forbidden Castle 'G.I. Joe 
•Garfield Double Dares 'General Manager 'Goonies 
•GraphicWriter 10 'Gutenberg, Sr. 'Hacker II 'Hardball 
•Hardball gs •Infiltrator 'James Bond 007: A View to 
a Kill 'Keyboard Kadet "Kids on Keys «Lazer Maze 'Le 
Demenagement »Le Francais par Ordinateur: 'Leisure 
Suit Larry in the Land of the Lounge Lizards *Les Sports 
•Lion's Workshop 'Microzine #21 •Microzine #22 
•Milliken Word Processor •Millionair II 'Multiscribe v2,0 
•Multiscribe v3.0 'Multiscribe llgs v3.0lc 'Paris En 
Metro 'Pitfall II 'Racter 'Railroad Works 'Rambo: First 
Blood Part II 'Realm of Impossibility 'Same or Different 
•Sea Dragon 'Sea Strike 'Shanghai 'ShowOff 
•Shutterbug 'Silent Service llgs 'Snoopy to the Rescue 
•Snoopy's Reading Machine 'Snoopy 's Skywriter 
Scrambler 'Space Quest I 'Space Station 'Spy Hunter 
•Spy's Adventures in Europe 'Spy's Adventures in North 
America 'Stephen King: The Mist 'Story Maker 'Street 
Sports Basketball 'Sub Battle Simulator 'Super Sunday 
Football 'Talking Text Writer 'Type! 'Un Repas Francais 
•Voodoo Island 'Where in Europe is Carmen Sandiego 
'Winnie the Pooh 'Winter Games 'Winter Games gs 
'Wordzzzearch 'World Games gs * MAPTs: »2400 
AD 'Kung-Fu Master 'Udy Tut 'Ultima V « MPhying 
Tips: '2400 AD -Deathford 'Space Quest 'Ultima IV 
•Ultima V "Wrath of Denethenor IBMM Softkeys: 
•Execu-Vision 'MS Word 'PC-Draw 'Zork I § El 



May 1988 * MFeatures: 'A Utility to 
Save the Lower 8 Pages of Memory 'Bard's Tale Effects 
Locator 'How to Capture Phantasie Screen Maps 
•Alternate Reality Character Editor 'Updating the 
ProDOS Block Editor 'Loading Flashcalc onto your 
RAMcard 'A Copyprotection Scheme for ProDOS 'The 
Product Monitor *Autoduel Car Editor * Softkeys: 
•Alphabet Sequencing 'Animal Alphabets and Other 
Things 'Arctic Antics 'The Boars' Store 'The Boars Tefl 
Time 'Career Focus 'Castle Wolfenstein 'Charlie Brown's 
1 2 J's 'Charlie Brown's ABC's »City Country Opposites 
•Coveted Mirror 'Create With Garfield 'Crypt of Medea 
•Customized Alphabet Drill 'Customized Flash Spelling 
•Dig Dug 'Digital Paintbrush System 'Estimation 'Fay: 
Word Hunter 'Fix It 'Focusing on Language Arts 
•Fundamental Capitalization 'Fundamental Punctuation 
Practice 'Fundamental Spelling Words in Context 'The 
Hobbit 'Homonyms in Context 'Individualized Study 
Master 'Inside Outside Shapes 'Inside Outside Opposites 
•Leisure Suit Larry in the Land of the Lounge Lizards 
•Master Diagnostics II £ 11+ 'Mastertype v2.l 
•Mathematics Series *Mr. and Mrs. Potato Head 'Paper 
Models - The Christmas Kit 'Peanuts Math Matcher 



•Peanuts Maze Marathon 'Peanuts Picture Puzzlers 
•Perry Mason: The Case of the Mandarin Murder 
•Railroad Works 'Random House Library 'Management 
Programs 'Rooky's Boots v. 4 'Sensible Speller 'Snoopy's 
Reading Machine 'Snoopy's Skywriter Scrambler 
•Snoopy to the Rescue 'Snoopy Writer 'Spelling Demons 
•Stock Market Simulation 'Story Builder 'Story Starter 
•Studio II 'Test Maker 'Think Quick vl .0 'Tournament 
Bridge 'Tutorial Comprehension 'Typing is a Ball, Charlie 
Brown 'Under Fire 'Word Blaster 'Word Count 'Word 
Mount 'Your Personal Net Worth * MAPTs: 'Under 
Fire IBMM Feature: •Flight Simulator RGB Modifications 



April 1988 * MFeatures: 'Picture Loader 
•How To Make DEMUFFIN PLUS 'Convert Print Shop 
graphics into Print Master graphics 'lower case letters 
For Your Apple II Plus 'The Product Monitor 'Apple He 
Paddle Fix 'Softkey for Daisy Professional 'Most- 
Protected' Award 'DOS EOR Maker * Softkeys: A2-PB I 
Pinball 'Animate 'Bank Street Music Writer 
•Boulderdash Construction Kit 'California Games 
•Countdown to Shutdown 'Coveted Mirror 'Create with 
Garfield 'Daisy Professional 'Destroyer 'Donkey Kong 
•Expedition Amazon 'General Chemistry Disk #8 
•Graphics Studio 'Green Globs $ Graphic Equations 
•Kalamazoo Teacher's Record Book 2.0 'Kids on Keys 
•Marble Madness *Math Blaster 'Maxwell Manor 
•Peanut's Maze Marathon 'Petro-Calc 'Police Artist 
■Practical Grammar 'Rendezvous 'Ring Quest 'Roadwar 
Europa 'Roadwar 2000 'Rocky Horror Show 'Sesame 
Street Electric Coloring Book Series 'Sesame Street Letters 
for Vou 'Sesame Street Numbers 'Seven Cities of Gold 
•Snoopy's Reading Machine 'Spy's Adventures In Europe 
•Spy's Demise 'Super Sunday Football "Talisman 
•Tellstar II *Top Draw v 1 .01 A 'The American Challenge 
•The Dam Busters *The Science Professor 'Tubeway 
•Vocabulary Adventure I 'Winter Games 'Wizards' 
Crown 'Zero-Gravity Pinball # MAPTs: 'Expedition 
Amazon 'Might and Magic * MPlaying Tips: 
•Beauracracy 'King's Quest II 'Lurking Horror 'Maniac 
Mansion 'Stationfall IBMM Feature: 'Introduction to 
IBM Disk Format, Access, and Copy-protection 'Putting 
Sargon HI on harddisk IBMM Softkeys: 'Prokey 3.0 
•R:base 400 'Time Manager 



March 1988 * MFeatures; 'Modify 
Super IOB to read/write every other track 'APT for Rings 
Of Zilfin: Turn yourself into a lean, mean fighting Machine 
•More Softkeys for M.E.C.C. software ( 1987 ) 'How 
To Use The Electronic Art's RWTS 'APT for Realms Of 
Darkness: Realm's Wrecker! 'Putting Super Boulder Dash 
onto a hard disk * MSoftkeys: '2400 A.D. 'Age Of 
Adventure 'Apple's Core II 'Arcade Boot Camp 'Arctic 
Fox 'Aztec 'Ballblazer 'Bard's Tale l!gs 'Blue Powder 
Gray Smoke 'California Games 'Championship Wrestling 
•Colonial Conquest 'Comprehension Skills 1,11 
•Conquering Whole Numbers 'Coordinate Math 
'Countdown To Shutdown 'Dataquest: The World 
Community 'Destroyer • Dream House "Dream Zone 
•Earth Orbit Station 'Equation Math 'Forecast: Vour 
At Home Weather Station 'Fraction Concepts Inc 
•Fraction Munchers 'Fraction Practice Unlimited »GBA 
Championship Basketball 'Genesis 'GFL Football 'Ghost 
Rider 'Goonies 'Grade Manager v2.3 'Great American 
Cross-country Road Race 'Hardball llgs 'Ikari Warrior 



•Jenny's Journeys »Kid Niki Radical Ninja *Kung-Fu 
Master 'Learning To Tell Time 'Leisure Suit Larry 'Let's 
Learn About Money "Let's Learn About The Library 
"Letters For Vou "Lords Of Conquest 'Magic Spells 
•Math Blaster "Money Works 'Maps S Globes: Latitude 
£ Longitude 'Marble Madness 'Microzine 
1 8, 1 9,20,2 1 ,22,23 'Mist 'Morning Star Math 'Movie 
Monster Game 'Multiplication Puzzles 'Multiscribe v3.0c 
•Murder On The Mississippi 'Music Made Easy 'Mystery 
Sentences 'Number Munchers 'Numbers Count 'Odell 
Lake 'Operation Frog 'Opposites Attract 'Oregon Trail 
v 1 .4 'Phonics Prime Time: Blends £ Digraphs 'Phonics 
Prime Time: Vowels I, II 'Puzzles S Posters 'Quotient 
Quest 'Reader Rabbit 'Reading Style Inventory "Realm 
Of Impossibility 'Sesame Street 'Crayon' series 'Shanghai 
•Sons Of Liberty 'Space Quest v2.2 'Story Book: 
Pixelworks 'Story Tree 'Subtraction Puzzles 'Super Huey 
•Super Wordfind "Tass Times In Tonetown "Those 
Amazing Reading Machines III, IV "Timothy Leary's Mind 
Mirror "To Preserve, Protect and Defend 'Tower Of 
Myraglen 'Troll's 'MicroCoarseware' series 'Webster: 
The Word Game 'Word Munchers 'Words At Work: 
Compound It 'Words At Work: Suffix Sense 'World 
Games 'World's Greatest Baseball Game 'World Karate 
Championship "Writer Rabbit 'Zoyon Patrol ft MAPTs: 
•Buck Rogers 'Ikari Warrior 'Kung-Fu Master 'Leisure 
Suit Larry llgs 'Marble Madness 'Realm Of Darkness 
•Rings Of Zilfin "Space Quest llgs *Super Boulder Dash 
tMPlaying Tips: '2400 A.D. 'Donkey Kong 
•Infiltrator 'Space Quest llgs 'Spy Hunter 'Swashbuckler 
•Thexder 'Ultima II • IBMM Softkeys: 'EasyWriter 1 .0, 
II 'Zork III 



February 1988 * MFeatures: 'The 
Product Monitor "Unprotecting The Unprotectabfe: 
Macintosh Softkeys! "A.P.T. Cornucopia 'APT: Alternate 
Reality -Dungeon: Create A Super-human 'Softkey for 
SSI's RDOS disks: I. ProDOS RDOS, 2.RD0S Transfer 
Utility 'Making Cracked II Plus Disks Work On The He 
* MSoftkeys: 'Apple Gradebook v2.6 'Award Maker 
Plus 'Black Cauldron 'Black Magic 'California Games 
•Car Builder 'Color Print Shop 'Computer Ambush 
•Concepts In Science "Disney's Comic Strip Maker 'Elite 
•Empire I, II 'European Nations £ Locations 'Fooblitsky 
•Grid Designer 'H.E.R.O. 'Ikari Warriors 'Infiltrator II 
•Le Francais par Ordinateur 'Little Computer People's 
House on a Disk *Main Street Filer 'Master Diagnostics 
He *MegaFiler +MegaMerge "Microzine 23 'Might 
S Magic * Millionaire 'Mindplay software 'Music 
Construction Set 'Nibbler 'Operation Market Garden 
•Phantasie + P1anetfall 'PrintMaster Plus 'Print Shop 
•Questran 'Regatta 'Ring Quest 'Ringside Seat 'Rings 
Of Zilfin 'Shanghai 'Silent Service 'Snooper Troops 
•Spy's Adventure in N. America "Super Print "Tass Times 
In Tonetown "Think Quick * Transylvania 'Ultima I re- 
release 'Where in the USA is Carmen Sandiego 'World 
Games + Zork I ( * Macintosh softkey) * MA P. T.s: 
Alternate Reality: The Dungeon "Arctic Fox "Bard's Tale 
II "Beyond Zork "Black Magic 'Cavern Creatures "Drol 
•Goonies • Ikari Warriors »Zorro tt MP laying Tips: 
•Beyond Castle Wolfenstein "Championship Lode Runner 
•Conan "King's Queen II "Lode Runner 'Luriung Horror 
•Station Fall -Ultima IV *Zork I BMMSojikevs: "Lotus 
I -2-3 'Flight Simulator 'PFS Report I BM A.P.T.S: 
•Bard's Tale 
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^) 1 January 1988 MFeatures: 'The Crypt- 
arith metre Helper 'Using EDD IV to Modify Tracks And 
Sectors 'Bard's Tale APT: Dungeon Mapper Revisited 
•RAMfactor mod for Laser 1 28 •Ultima IV APT edit- 
tables 'The Product Monitor 'Get Better Sound by using 
the cassette jacks 'Making A Fast Boot Disk 'Might 5 
Magic APT edit-tables MSoftkeys: '2400 AD "Aliens 
•Alphabet Zoo •Amnesia 'Bag Of Tricks "Bard's Tale 
I «Bard's Tale II 'Battle Cruiser 'Beach-head II 'Below 
The Root 'Black Magic 'Body Awareness 'Bridge 4.0 
•Carriers At War 'Catalyst 3,0 'Centipede 
•Championship Boxing "Championship Wrestling 
•Chessmaster 2000 'Combining The Elements 
•Commando 'Creative Contraptions 'Einstein Compiler 
•Fat City "Fight Night "Flight Simulator v2.0 'Fun with 
Direction 'GBA 1 -On -2 Championship Basketball 
•Graph icWriter vl .IRA "Growing Up Small "House-on 
a-disk "Intrigue "Jet "Jungle Hunt 'Kindercomp 
•Knowing Numbers "Kung-fu Master "Law Of The West 
•Learning Well series "Letters And Words "Little 
Computer People "Make Your Own Murder Party "Manic 
Mansion "Master Diagnostics "Movie Maker "Music 
Construction Set "Pinball Construction Set "Pitstop •Print 
Shop Graphics Library Holiday 'Print Shop llgs 
•Rendezvous 'Shapes And Patterns "Silent Service 
•Sorcerer »Spy vs Spy I % II "Stargate "Stellar 7 
•Stickybear ABCs »Stickybear Drawing "Stickybear 
Numbers "Stickybear Printer "Stickybear Printer Library 
I % II "Stickybear Townbuilder "Super Boulderdash 
•Temple Of Apshai Trilogy •Tomahawk 'Thexder 'Walt 
Disney's Card And Party Shop 'Walt Disney's Cartoon 
Maker 'Wings Of Fury "Word Maze "World's Greatest 
Baseball Game »Zork III MA.PT.s: Bard's Tale 'Lode 
Runner "Might S Magic "Ultima IV »W. Disney's Card 
And Party Shop "Wizardry III "Wizardry IV MPIaying 
Tips: 'Autoduel "King's Quest "Manic Mansion "Summer 
Games *Tass Times In Tonetown 'Thexder 'Where In 
the World is Carmen Sandiego? 



December 1987 MFeatures: "Super 
Boulderdash APT -writer "Softkeys to Activision/ MECC/ 
and PFS ProDOS/ software 'Double F-8 ROM space w/o 
motherboard surgery "Ace-Apple bimodal Switch "Using 
Sider hard drives 3 1 /:", 800K drives, S 5'4" drives in 
DOS 3.3 MSoftkeys: 'Aliens "Alter Ego "Alternate 
Reality "Amazing Reading Machines "Amazon 
•American Challenge "Arcade Album # I "Arithmetic 
Critters "Award Maker "Baseball Database "Bard's Tale 
II: Destiny Knight 'BC's Quest for Tires *Bop 6 Wrestle 
•Champ. Boxing 'Champ. Wrestling 'Clock Works 
•Commando "Computer Prep for SAT 'Conflict In 
Vietnam "Counting Critters 'Crisis Mountain "Dataquest 
50 States 'Deluxe Paint II "Dino Eggs "Disney Card % 
Party Shop "Disney Comic Strip Maker "Draw Plus 
•Eidolon "Electric Crayon ABCs "Expedition Amazon 
•Facemaker "First Letter Fun "Fish Scales "Fun From 
A-Z 'Game Maker "GBA Champ. Basketball "GFL 
Champ. Football "Graphicwriter I .OR/ 1 . 1 R "Great Road 
Race "Hacker II "Hardball "Infiltrator II "instant Music 
•James Bond 007: A View To A Kill 'Jenny's Journeys 
•Kung Fu Master "Little People "List Handler 'Manic 
Mansion "Mastery Arithmetic Games "Market Place 
•Master of Lamp "Math Rabbit 'Microiine #17 'Might 
and Magic 'Mission In Solar System "Moebius "Music 



Construction Set "Music Studio "Number Munchers 
•Paint With Words 'Paintworks Plus 'Path Tactics 
•pfsfile »pfs:Graph »pfs:Plan »pfs:Report 'pfs:Write 
•Phonics Prime Time •Portal •Principal's Assistant 'Print 
Shop ProDOS 8 vl .4 'Print Shop Holiday Edition 
•Quickflash! 'Reader Rabbit 'Realm of Impossibility 
•Robot Odyssey I v.10 «Rocky Horror Show 'Rocky's 
Boots v4.0 'Saracen 'Shanghai 'Silent Service "Skylab 
•Sound Tracks 'Speedy Math 'Spindizzy 'Street Sports 
Baseball 'Sub-Mission 'Super Boulderdash 'Tass Times 
in Tonetown 'Thexder 'Top Fuel Eliminator 'Word 
Handler 'Word Munchers 'Words at Work 'World 
Karate Champ. 'Writer's Choice: Elite 'Zardax v5. 2. 1 



November 1987 MFeatures: 'Eliminate 
some ProDOS erroneous error messages 'Date/time 
without a clock card 'Sector surgery: recover lost files 
•Generating Applesoft programs 'on-the-fly' 'Product 
Monitor reviews *PLUS: How to convert List Handler 
files into standard text files 'How to make 
GRAPHlC.GRABBERv3 run on the llgs 'Laser 128 
'absolute* RESET MPIaymg Tips: 'Bard's Tale II 'Conan 
•Donkey Kong 'Hacker I 'Hard Hat Mack 'Orbitron 
•Print Shop Companion 'Spellbreaker 'Spy Hunter 
•Ultima 4 MA.P.T.s: Infiltrator 'Lode Runner 
•Montezuma's Revenge 'Swordthrust series MSoftkeys: 
•Addition Logician 'Animate 'Arcade Boot Camp 
•Arctic Fox 'Bard's Tale II 'Cat'n Mouse 'Counting 
Critters »Dam Busters t 'Destroyer 'Draw Plus v 1 .0 
•Dr. Ruth's Comp. Game Of Good Sex 'Echo 1.0 
•E.D.D, 4 •Garnemaker 'Hard Ball 'Infiltrator 'List 
Handler f 'Locksmith 6,0 Fastcopy t 'Magic Slate 
•Math Critters 'Millionaire *Mind Mirror 'One On One 
•Paintworks Plus v 1 .0 'Paintworks Plus v I . I 'PHM 
Pegasus 'Portal 'Quotient Quest 'Reader Rabbit 
•Saunder's Chemistry CAI 'Science Toolkit 'Shanghai 
•Strip Poker t 'Super Bunny 'Super Sunday 
•Swordthrust series T •Term Paper Writer »Thief 'Top 
Fuel Eliminator »Typing! t »Llp-n-Down 'Willy Byte 
•Writer's Choice Elite v 1 .0 'Writing A Character Sketch 
•Writing A Narative 



October 1987 MFeatures: 'Dungeon 
Editor % Encounter Editor for Ultima III *APT for 
Shadowkeep •Softkey for Shadowkeep "Softkey for Apple 
Business Graphics MSoftkeys: »8 1 6 Paint GS •Amnesia 
•Arctic Fox 'Award Maker Plus 'Bard's Tale II 
•Betterworking Word Processor 'Beyond Castle 
Wolfenstein 'Black Magic 'Bookends Extended 'Bop S 
Wrestle 'Chess 7.0 'Chessmaster 2000 'Deluxe Paint 
GS 'Destroyer 'Hacker II 'Hacker II GS 'Hardball 
•Infiltrator 'Instant Music GS 'J-Bird 'Mabel's Mansion 
•Marble Madness 'Mean 1 8 GS Golf 'Megabots 'Might 
£ Magic 'Miner 2049er II 'Mouse Word 'Music 
Construction Set GS 'Music Studio 6S 'New Oregon Trail 
•Paintworks Plus I .OGS 'Paintworks Plus LOGS 'Paul 
Whitehead Teaches Chess "PHM Pegasus 'Poetry Express 
•Print Shop color version »Rambo: First Blood part II 
•Rocky Horror Show «Sargon III* 'Shanghai GS 
•Spindizzy 'TelePorter 'Temple Of Apshai trilogy 'Top 
Draw GS 'Transylvania 'Ultima I 'World's Greatest 
Baseball Game 



Ulti mapper IV 'Towne Mapper utility for Ultima IV 
•Dungeon Mapper utility for Bard's Tale MHardware 
Corner: Interrupting Your Apple 'Softkey for Charlie 
Brown's 1 ,2,3s MSoftkeys: 'Guitar Wizard 'Gemstone 
Warrior 'Notable Phantom 'Micro Wine Companion 
•Stickybear Printer 'Note Card Maker 'Starcross 
•Wishbringer 'Dinosaur Dig "Darn Busters 'Pirate 
Adventure 'Infiltrator 'MECC software 'Banner Catch 
•Turtle Tracks 'PFS File 'Microzine #12. #13. #14 
•Marble Madness 'Writer Rabbit 'Arcticfox 'Age Of 
Adventure 'Might And Magic 'Space Station 'Alternate 
Reality 'Mindshadow 'Gemstone Warrior 'Strip Poker 
•Lucifer's Realm 'Manuscript Manager 'Bank Street 
Writer III 'Kids On Keys 'The Missing Ring 'Graphic 
Solution 'Empire I, II 'Champ. Golf 



August 1987 MSoftkeys: 'Advanced 
Microsystems Technology programs *Word Attack 'Star 
Blazer 'Science Toolkit 'The Color Enhanced Print Shop 
•Video Vegas 'The Handfers 'K.C. Deals On Wheels 
•Law Of The West 'Break The Bank Blackjack 
•Foundation Course In Spanish *OGRE 'Puzzles And 
Posters MFeatures 'The Shift Key/Lower Case Option 
For 11+ 'Amazing Computer Facts 'Shape Magic utility 
MReview. M u It i scribe 



July 1987 MSoftkeys: 'Mouse Calc 
•Sands of Egypt "Number Farm 'Agent U.S.A. "Wavy 
Navy "Kindercomp "Flight Simulator Update "Raid over 
Moscow "Crime Stopper 'Key Perfect 5. 'The Final 
Conflict 'Miss Mouse 'Snoggle MFeatures 'Write 
Protecting the Microsoft RAM Card 'Keys to Success on 
the Franklin Ace 'Modified F8 ROMs on the Apple /// 
MCore 'Owner's Review of Copy Master II 



June 1987 MSoftkeys: 'Arcade Boot 
Camp 'Goonies 'Zorro 'Coveted Mirror 'Crimson 
Crown 'Compubridge 'Fleet System 3 'Microwave 
•Escape 'Catalyst 3.0 'Number Farm 'Alphabet Circus 
•Joe Theisman's Pro Football 'Black Cauldron •Intern. 
Gran Prix MFeatures 'Making DOSIess Utilities "Pixit 
Printer Drivers MReview: Z-RAM Memory Expansion 
Board 'Reading the Joystick 



May 1987 MSoftkeys: 'Graphics 
Expander 'Information Master 'Certificate Maker 'Elite 
•Catalyst 2.0 and 3.0 'Murder On The Mississippi 
•Temple Of Apshai Trilogy 'Troll Associates programs 
•Speli It 'Regatta 'Cdex Training programs 'Think Fast 
MFeatures 'How to Write-Protect your Slot Zero 
•Capturing Locksmith 6.0 Fast Copy 'Revisiting DOS 
to ProDOS and Back MCore 'Computer Eyes / 2; a 
Review MAPTs 'Sword of Kadash £ Rescue Raiders 
•Ultimaker IV 



September 1987 MFeatures: 'Infocom- 
text Reader Enhancement 'Color Ultimapper mod to 



April 1987 MSoftkeys: 'Light Simulator 
•Beach-Head »Monty Plays Scrabble 'Racter 'Winnie 
the Pooh 'Infocom Stuff, Kabul Spy, Prisoner II 'Wizardry 
I & 2 'Lucifer's Realm 'The PFS Series 'Dollars and 
Sense 'Strip Poker 'Coveted Mirror 'Wizard's Crown 
•The Swordthrust Series 'Axis Assassin 'Manuscript 
Manager 'The Crown of Arthain 'Address Book 
•Decimals 3.0 •Dragonfire MFeatures »Auto Duel Editor 
•Wizard's Crown Editor •Questran Mapper MCore 'The 
Games of 1 986 in Review MAdventure Tips 'Ultima IV 
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April 1987 MSofikeys: •Light Simulator 
•Beach-Head 'Monty Plays Scrabble "Racier 'Winnie 
the Pooh 'Infocom Stuff, Kabul Spy, Prisoner II 'Wizardry 
I £ 2 "Lucifer's Realm 'The PFS Series "Dollars and 
Sense 'Strip Poker 'Coveted Mirror 'Wizard's Crown 
•The Swordthrust Series "Axis Assassin 'Manuscript 
Manager 'The Crown of Arthatn 'Address Book 
•Decimals 3.0 •Dragonfire MFeatures 'Auto Duel Editor 
•Wizard's Crown Editor 'Questran Mapper MCore 'The 
Games of 1 986 in Review MAdventure Tips 'Ultima IV 

TB 1 March 1987 MSofikeys: 'The Periodic 
Table 'Gemstone Warrior 'Inferno "Frogger 'Story 
Maker 'Adventure Writer "Mummy's Curse 'Zaxxon 
•The Quest 'Pitfall II 'H.E.R.O. MFeatures «A Two-Drive 
Patch for Winter Games 'Customizing the Speed of a 
Duodisk 'Roll the Presses Part Two: Printshop Printer 
Drivers 'The Games of J 936 

40 February 1987 MSoftkeys: 

•Adventure Writer »E-Z Learner 'Myehess II 'Raster 
Blaster 'Cranston Manor "Ghostbusters 'Designer's 
Pencil 'The American Challenge 'Encyclopedia Britannica 
Programs 'Crime Wave MFeatures 'Taking the Wiz out 
of Wizardry 'Adding a Printer Card Driver to Newsroom 
MCore Games of 1986 



January 1987 MSofikeys: 'MIDI'S + 
•Homeword v2.l 'Borrowed Time 'Amazon "Speed 
Reader ][ 'Discovery! 'M-ss-ng L-nks series "Donald 
Ducks's Playground 'Mastering the SAT 'Copy ][ Plus 
4.4C 'Master of the Lamps »One on One 'Bridge Baron 
•A.E. 'Great American Cross-Country Road Race 
•Computer Preparation for the SAT •Castle Wolfenstein 
•Luscher Profile 'Skyfox 'Silent Service 'Echo Plus 
•Swashbuckler *Randamn MFeatures 'Electronic Disk 
Drive Swapper 'Abusing the Epilogues 'Print Shop 
Companion's Driver Game MCore 'Keyboard Repair 
•Fixing the Applesoft Sample Disk 



December 1986 MSoftkeys: 'Cyclod 
•Alternate Realty "Boulder Dash I £ II »Hard Hat Mack 
(Revisited) "The Other Side 'F-15 Strike Eagle 
•Championship Lode Runner *Gato V 1.3 "I, Damiano 
•Wilderness 'Golf's Best MFeatures 'The Enhanced/ 
Unenhanced tie 'Looking into Flight Simulator's DOS 
MCore 'Appavarex 'Installing a RAM disk into DOS 3.3 



November 1986 MSofikeys; 'Under 
Fire 'Pegasus j 'Take I [revisited) 'Flight Simulator II 
v 1 ,05 (part 2) 'Magic Slate "Alter Ego 'Rendezvous 
•Quicken "Story Tree 'Assembly Language Tutor 
•Avalon Hill games 'Dark Crystal MFeatures "Playing 
Karateka on a lit "Track Finder 'Sylk to Dif MCore 
•Breaking In: tips for beginners *Copy ][ Plus 6,0: a 
review 'The DOS Alterer 



October 1986 MSofikeys: 'Flight 
Simulator II v 1 .05 'AutoDuel 'Critical Reading 'Troll's 
Tale 'Robot War 'General Manager •Plasmania 
•Telarium Software "Kidwriter vl.O 'Color Me 
MFeatures "ScreenWriter meets Flashcard 'The Bus 
Monitor 'Mousepaint for non- Apples MCore "The Bard's 
Dressing Room MAPT 'Championship Lode Runner 



September 1986 MSofikeys: 'Olympic 



Decathlon "Hi-res Cribbage •Revisiting F- 1 5 Strike Eagle 
•Masquerade *The Hobbit "Pooyan »The Perfect Score 
•Alice in Wonderland »The Money Manager *Good 
Thinking 'Rescue Raiders MFeature: Putting a New F8 
on Your Language Card MCore: 'Exploring ProDOS by 
installng a CPS Clock Driver 



August 1986 MSoftkeys 'Crisis 
Mountain 'Temp in Logo 'Apple Logo II 'Fishies 1 .0 
•SpellWorks 'Gumball 'Rescue at Rigel 'Crazey Mazey 
•Conan •Perry Mason: The Case of the Mandarin Murder 
•Koronis Rift MFeature: "More ROM Running MCore: 
•Infocom Revealed 



July 1986 MSoftkeys "Word Juggler 
•Tink! Tonkl "Sundog vlO »G.I. Joe £ Lucas Film's 
Eidolon 'Summer Games II 'Thief "Instant Pascal 
•World's Greatest Football Game "Graphic Adventure 
» I "Sensible Grammar £ Extended Bookends "Chipwits 
•Hardball 'King's Quest II "The World's Greatest Baseball 
Game MFeature: *How to be the Sound Master MCore: 
•The Mapping of Ultima IV 



June 1986 MSofikeys 'Revisiting Music 
Construction Set "Cubit "Baudville Software 'Hartley 
Software 'Bridge 'Early Games for Young Children 
•Tawala's Last Redoubt- 'Print Shop Companion 
•(tracking Vol II 'Moebius 'Mouse Budget, Mouse Word 
£ Mouse Desk 'Adventure Construction Set MFeature: 
•Using Data Disks With Microzines MCore: 'Super IOB 
v 1,5 a Reprint 

«S 1 May 1986 MSofikeys 'Trivia Fever 
•The Original Boston Computer Diet 'Lifesaver 
•Synergistic Software 'Blazing Paddles 'Zardax "Time 
Zone 'Tycoon "Earthly Delights 'Jingle Disk 'Crystal 
Caverns 'Karate Champ MFeature: 'A Little Help With 
The Bard's Tale MCore: "Black Box 'Unrestricted 
Ampersand 



April 1986 Softkeys 'Millionaire 'SSI's 
RDOS 'Fantavision 'Spy vs. Spy "Dragonworld 'King's 
Quest 'Mastering the SAT 'Easy as ABC 'Space Shuttle 
•The Factory 'Vtsidex LIE "Sherlock Holmes "The 
Bards Tale •Feature 'Increasing Your Disk Capacity 
'Core 'Ultimaker IV, an Ultima IV Character Editor 



March 1986 Softkeys "Threshold 
•Checkers v2. 1 *Microtype "Gen. £ Organic Chemistry 
Series 'Uptown Trivia 'Murder by the Dozen 
•Windham's Classics "Batter Up "Evelyn Wood's 
Dynamic Reader 'Jenny of the Prairie 'Learn About 
Sounds in Reading 'Winter Games 'Feature 
•Customizing the Monitor by Adding 65C02 
Disassembly 'Core *The Animator 



February 1986 Softkeys 'Ultima IV 
•Robot Odyssey •Rendezvous "Word Attack £ Classmate 
•Three from Mindscape 'Alphabetic Keyboarding 
•Hacker 'Disk Director 'Lode Runner 'MIDI/4 'Algebra 
Series 'Time is Money "Pitstop II 'Apventure to Atlantis 
'Feature 'Capturing the Hidden Archon Editor 'Core 
•Fingerprint Plus: A Review 'Beneath Beyond Castle 
Wolfenstein (part 2) 



Beta Filer 'Sword of Kadash 'Another Miner 2049er 
•Learning With Fuzzywomp "Bookends "Apple Logo II 
•Murder on the Zinderneuf 'Features *Daleks: Exploring 
Artificial Intelligence 'Making 32K or 1 6K Slave Disks 
•Core 'The Games of 1985: part II 



Softkeys 'Cannonball Blitz 'Instant Recall 
•Gessler Spanish Software "More Stickybears 'Financial 
Cookbook "Super Zaxxon 'Wizardry 'Preschool Fun 
•Holy Grail »lnca 'I28K Zaxxon 'Feature 'ProEdit 
'Core 'Games of 1985 part I 



Softkeys »DB Master 4.2 'Business Writer 
•Barron's Computer SAT *Take I "Bank Street Speller 
•Where In The World Is Carmen Sandiego »Bank Street 
Writer 1 28K »Word Challenge "Spy's Demise »Mind 
Prober 'BC's Quest For Tires "Early Games "Homeword 
Speller 'Feature "Adding IF THEN ELSE To Applesoft 
'Cm "DOS To ProDOS And Back 



Softkeys 'Electronic Arts software 'Grolier 
software 'Xyphus 'F-15 Strike Eagle "Injured Engine 
•Mr. Robot And His Robot Factory •Applecillin II 
•Alphabet Zoo 'Fathoms 40 'Story Maker 'Early Games 
Matchmaker 'Robots Of Dawn 'Feature* Essential Data 
Duplicator copy parms 'Core "DOS-Direct Sector Access 



Softkeys 'Chop lifter "Mufplot 'Flashcalc 
•Karateka "Newsroom »E-Z Draw »Gato »Dino Eggs 
•Pinball Construction Set *TAC »The Print Shop: 
Graphics Library 'Death In The Caribbean 'Features 
"Using A.R.D. To Soft key Mars Cars 'How To Be The 
Writemaster 'Core 'Wheel Of Money 



Softkeys 'Miner 2049er 'Lode Runner 
■A2-PB I Pinball 'The Heist 'Old Ironsides 'Grandma's 
House 'In Search of the Most Amazing Thing 'Mcrloc's 
Tower "Marauder 'Sargon III 'Features 'Customized 
Drive Speed Control 'Super IOB version 1 .5 'Core 'The 
Macro System 



Softkeys 'Sargon III 'Wizardry: Proving 
Grounds of the Mad Overlord and Knight of Diamonds 
•The Report Card V I . I "Kidwriter 'Feature 'Apple |[ 
Boot ROM Disassembly 'Core 'The Graphic Grabber 
v3.0 'Copy 11+ 5.0: A Review 'The Know-Drive: A 
Hardware Evaluation 'An Improved BASIC'Binary Combo 

1 5^ Softkeys 'Rendezvous With Rama 
•Peachtree's Back To Basics Accounting System 'HSD 
Statistics Series 'Arithmetickle 'Arithmekicks and Early 
Games for Children 'Features "Double Your ROM Space 
•Towards a Better F8 ROM »The Nibbler: A Utility 
Program to Examine Raw Nibbles From Disk 'Core 'The 
Games of 1934: In Review-part II 



January 1986 Softkeys 'Microzines I -5 
•Microzines 7-9 | Microzines (alternate method) »Phi 



Softkeys "Sensible Speller for ProDOS 
•Sideways "Rescue Raiders "Sheila • Basic Building Blocks 
•Artsci Programs 'Crossfire 'Feature 'Secret Weapon: 
RAMcard 'Core 'The Controller Writer »A Fix For The 
Beyond Castle Wolfenstein Softkey 'The Lone Catalog 
Arranger Part I 

1 Softkeys 'Data Reporter "Multiplan *Zork 
'Features 'PARMS for Copy II Plus "No More Bugs 
•APT's for Choplifter £ Cannonball Blitz ''Copycard' 
Reviews "Replay "Crackshot 'Snapshot 'Wildcard 
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mSt 1 MSoftkeys: »DB Master version 4+ 'Dazzle Draw "Arehon 
•Twerps MReaders ' Softkeys: •Advanced Blackjack 'Mega works •Summer 
Games "College Entrance Exam Prep •Applewriter revisited MFeatures: 
•Demystifying The Quarter Track ■ Core: "Proshadow: A ProDOS Disk 
Monitor 



io 



M Softkeys: • Scholastic Version of Bank Street Writer 
•Applewriter He 'SSI's Non-RDOS Disks MReaders' Softkeys: "BPI 
Accounting Programs and Design Ware Programs ■ Features: 'Installing 
a Free Sector Patch Into Applewriter Hi 'Simple Copy Protection ■ Core: 
•The Games of 1984: In Review '65C02 Chips Now Available •Checksoft 
v2 



M. M. MSoftkeys: "The Print Shop »Crossword Magic »The Standing 
Stones 'Beer Run • Sky fox 'and Random House Disks ■ Features: 'A 
Tutorial For Disk Inspection and the Use Of Super IOB »S-C Macro Assembler 
Directives (reprint) ■ Core: "The Graphic Grabber For The Print Shop 'The 
Lone Catalog Arranger Part Two 



MSoftkeys: 'Mastertype 'Stickybear BOP »Tic Tac Show 
MReader's Softkeys: »The Financial Cookbook 'Escape from Rungistan 
•Alien Munchies 'Millionaire "Plato MFeatures: "MREAD/MWRT Update 

■ Core: 'A Boot from Drive 2 'DB Master's Data Compression Techniques 

■ Whiz Kid: 'DOS and the Drive ■ Part One MAdventure Tips: 'Time 
Zone 'Mission Asteroid 'Enchanter 'Zork I 'Ultima • Ultima II 'Death 
in the Caribbean »Gruds in Space "Zork III "Starcross 



14 



IFeatures: 'Super IOB v 1 .2 Update 'Putting Locksmith 5.0 
Fast Copy Into a Normal Binary File 'Batman Decoder Ring 'A fix for 
Disk Edit W Softkeys: 'Seadragon • Rocky' s Boots "Knoware 'PFS Software 
•Computer Preparation SAT 'MatheMagic MReview: "Boulder Dash 



1 «9 WSofikeys *Laf Pak *Beyond Castle Wolfenstein 
"Transylvania "The Quest •Electronic Arts 'Snooper Troops (Case 2) 'DLM 
Software "Learning With Leeper 'Tel I Star ■ Core: »CSaver: The Advanced 
Way to Store Super IOB Controllers 'Adding New Commands to DOS 3.3 
"Fixing ProDOS 1 .0. 1 BSAVE Bug MReview: 'Enhancing Your Apple 
■ Feature: "Locksmith 5.0 and Locksmith Programming Language. 



ISoftkeys: 'Arcade Machine 'Bank Street Writer »Minit Man 
MReader's Softkeys •Senible Speller IV 'EDD IV «*Krell LOGO 'Canyon 
Climber MFeatures: "The Controller Saver "Examining Protected Applesoft 
BASIC Programs "Crunchlist II MCore: "Applear - Voice Aynthesis 
"Introducing the 65SC802 and 65SC8I6 Chips 'Review - Dino Eggs 
MAdventure Tips: "Cranston Manor "Zork I "Planetfall 'Mission Asteroid 
•Time Zone "Suspended "Critical Mass "Zork II "Castle Wolfenstein 



*S3r M Softkeys: "Sensible Speller "Sierra -On- Line Software »The Visible 
Computer: 6502 MReader's Softkeys: »Visidex "Music Construction Set 
•Gold Rush 'Visiterm "Cosmic Combat ■ Features: "Super IOB 
MAdventure Tips: "Pirate Adventure "Mask of the Sun "Colossal Caves 
•Transylvania "Death in the Caribbean "Zork II BCore: "Word Search 
Generator "ProDOS to DOS "ProDOS on a Franklin Ace 



43> MSoftkeys: "Robotron "Legacy of Llylgamyn "The Artist 'Data 
Factory v5.0 • EDD IV MReader's Softkeys: "Spy Strikes Back "Hayden 
Software "Apple LOGO MFeatures: "Review of the Bit Copiers ■ Core: 
•COREfiler "ProDOS Data Encryptor MAdventure Tips: "Ulysses and The 
Golden Fleece "Serpentine "Ultima II "Castle Wolfenstein "Death in the 
Caribbean "Zork I "Zork II 'Gruds in Space "Enchanter 'Infidel 'Serpent's 
Star ■ Whiz Kid: »How Data is Stored on Disk 



M\ MSoftkeys: 'Zaxxon 'Mask of the Sun 'Crush, Crumble % Chomp 
•Snake Byte "DB Master "Mouskattack MFeatures: "Making Liberated 
Backups That Retain Their Copy Protection "S-C Assembler: Review 'Disk 
Directory Designer MCore: »COREfiler: Part I "Upper % Lower Case 
Output for Zork 



O MSoftkeys: "Pandora's Box 'Donkey Kong 'Caverns of Freitag 
•Visifile MFeatures: 'Program Enhancements: Quick.Bug 'Personalizing 
A Program "Modified ROMs MReview 'Essential Data Duplicator "The 
CIA MCore: 'Data Bases 



39 MSoftkeys: »Homeword »Aztec •tBag of Tricks "Egbert II 
•Starcross 'Hard Hat Mack 'The Home Accountant MReader's Softkeys: 
•Dark Crystal 'Screenwriter II 'Visifile 'Lancaster "Bill Budge's Triolgy 
of Games "Sammy Lightfoot »Amper-Magic "Buzzard Bait MFeature: 
•Getting on the Right Track 



•L a MSoftkeys: "Zoom Graphix "Flip Out »Lion's Share "Music 
Construction Set MReader's Softkeys: "Hi-Res Computer Golf II "Suicide 
•Sabatage "Millionaire "Time is Money "Type Attack MFeatures .Pseudo- 
ROMs on the Franklin Ace ■ Core: "Psychedelic Symphony "The CORE 
Disk Searcher »The Armonitor MAdventure Tips: "Cranston Manor • 
Enchanter "Kabul Spy "Colossal Caves "The Witness "Pirate Adventure 
•Ultima Ill-Exodus 'Adventureland 



M. M. MSoftkeys: 'Sensible Speller 'Exodus: Ultima III MReaders ' 
Softkeys: "SoftPorn Adventure "The Einstein Compiler v5.3 "Mask of The 
Sun MFeatures : 'Copy II Plus v4.4C: Update Of An Old Friend 'Parameter 
List For Essential Data Duplicator MCore: 'Ultimaker III 'The Mapping 
of Ultima III 'Ultima II... The Rest Of The Picture 



^S MFeatures: Ultima II Character Editor MSoftkeys "Ultima II 
•Witness "Prisoner II "Pest Patrol MAdventure Tips: 'Ultima II 6 III 
■ Copy II Plus Partus Update 



*S MSoftkeys: "Bag of Tricks 'Multiplan MReaders' Softkeys: 
•Visiplot /Visitrend "Sneakers "Wizardry MFeatures 'No More Bugs: The 
Sequel "Hidden Locations Revealed "Map Maker MA.P.T.s "Choplifter 
MAdventure Ttps 'Cranston Manor 'Strange Odyssey 



&■ MSoftkeys: "Magic Window II 'Multiplan MFeatures: "Parameters 
for Locksmith 4.1 "Page Flipper "String Plotter 'Three-D Wall Draw 
MCore: Checksums MInput "Reviews of unprotected commercial software 
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Best of Hardcore Computing*. • LJ * 

Only the disk la available 

Core Special Combo $10 [J * * 

(All throe CORE magazines; no disks) 

Some disks apply Id more than one Issue and are shown astallBf twins. 
Special "Both" disk & magazine combination orders, apply to one issue 
and its corresponding disk. 

■*- Limited supply; first-come-flrst-serve basts, 

* Not available. 
O Out-of-print; only 'Zeroxed h copies for sale. 



COMPUTIST 

back issues and library disks are 
frequently referenced in current issues. 



Back Issues and Library Disk Rates 



• US, Canada and Mexico back issue rate - $4.75 each. 

• All other Foreign back issue rate - $8.75 each. 

• US, Canada, Mexico library disk rate - $9.95 each. 

• All other Foreign Library disk rate - $11.94 each. 

• "Both" disk and magazine rates for: 

US, Canada & Mexico - $12.95 each combination. 
All other Foreign - $18.95 each combination. 

Wkai i& a ettfiaxtj dvshl 

A library disk is a diskette that contains programs that would normally have to be typed in by 
the user. Documentation for each library disk can be found in the corresponding issue. 

• Library disks are available for all issues of COMPUTIST i 1 thru 57. If you wish to purchase 
a library disk not listed on the left (under the DISK column), used the out-of-print back issues 
ad on page 42. 

C&mf>£ete Ifowt CeMeeUwtl 

CORE 3 Games: Constructing Your Own Joystick' Compiling Games* GAMEREVlEWS; 
Over 30 of the latest and best* Pick Of The Pack: All-lime TOP 20 games* Destructive Farces* EAMON* Graphics Magician 
and GraFOFtTH* Dragon Dungeon , . , - ■ ■ 



CORE 2 

Find* Quick Copy: Copy* . 



Utilites: Dynamic Menu* High Res: Scroll Demo* GOTO Label: Replace* Line 



1 Graphics : Memory Map* Text Graphics: Marquee* Boxes* Jagged Scroller* Low 
Res: Color Character Chart* High Res: Screen Cruncher* The UFO Factory* Color* Vector Graphics:Shimmering Shapes* 
A Shape Table Mini-Editor* Block Graphics: Arcade Quality Graphics for BASIC Programmers* Animation 



Name. 



ID#. 



Address 



City 



State 



Zip 



Country . 



. Phone . 



Exp. 



Signature. 



_CP57 



• US funds drawn on US bank • Most orders shipped within 5 working days, however please allow up 
to 4 weeks delivery for some orders. • Most orders shipped UPS, so please use street address. • Offer 
good while supply lasts. • In Washington state, add 7.8% sales tax. »SBnd check/money order to: 

COMPUTIST PO Box 110846-T Tacoma, WA 98411 (206) 474-5750 
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tKe COMPUTIST shopper 



Software Package 



lie I I gs Software Package 



He 



lift 



B16 Paint 

Airheart 

Award Maker Plus 

Bank Street Writer 64K. .. , 

Bank Street Speller 

Bank Street Mailer 64K 

Bank Street Filer 64K 

Bank Street Writer Plus (128K) 

Bank Street Mailer 128K 

Bank Street Filer 12BK 

Beagle Graphics 

Beyond Zork 

Black Cauldron — 

Captain Goodnight 

Championship Karate 

Clip Art Gallery (for Paintworks Plus). 

Copy II Plus vfi.O 

Dazzle Draw ,..., 

Destroyer 

DiskQuirk 

Draw Plus 

F-15 Strike Eagle 

Fantavision 

Flight Simulator II 

Gamemaker 

The Graphics Studio 

Hacker II 

Hardball 

Hitchhiker's Guide 

Infiltrator II 

Jet 

Karateka 

Knight of Diamonds 

Labrinth 

Legacy of Llylgamyn 

Loderunner 

Macroworks 

Math Blaster 

Math Rabbit 

Mean 18, Ultimate Golf 

Merlin ProDOS 

Might & Magic 

Millionaire II 

Mousewrite . , 

Multiscribe 

Music Studio 

Paintworks Plus 

Portal 



$45.00 □ 
$24.00 □ 
$24.00 □ 
$46.00 □ 

$46.00 P 
$46.00 D 
$46.00 a 

$46.00 a 
$46.00 D 
$46.00 a 
$35.00 D 
$27.00 D 
$27.00 □ 
$24.00 D 

si4.00 a 

$20.00 □ 
$23.00 a 
$40.00 □ 
$25.00 a 

$18.00 a 

$52.00 a 
$24.00 a 
S34.O0 □ 
$36.00 a 
$34.00 D 
$42.00 □ 

$25,00 a 

$22.00 □ 
$20.00 □ 

$20.00 □ 

$29.0© □ 

$24.00 a 
$23.00 a 
$20.00 D 
$26.00 D 
$24.00 D 

$20.00 a 

$28.00 a 

$27.00 a 
$28.00 a 
$66.00 □ 
$32.00 □ 
$40.00 a 
$99.00 D 
$45.00 a 
$52.00 G 
$52.00 □ 
S30.00 D 



$45.00 a 



$23.00 □ 



$40.0© a 



$30.00 a 

$28.00 a 



$99.00 □ 
$66.00 n 



The Print Shop 

Print Shop Companion 

Print Shop Graphics Library: 

Disk One 

Disk Two 

Disk Three 

Pro-Byter 

Racter 

Reader Rabbit 

Rocky's Boots 

Science Tool Kit: Master Module 

Shanghai 

Silent Service 

Solo Flight 

Space Quest 

Star Trek- The Kobayashi Alternative. . 
Star Trek II- The Promethean Prophecy 
Stickybear Series: 

ABC's 

Math I 

Math II 

Numbers 



Shapes 

Typing 

Writer 

Sub Mission 

Summer Games 

Super Macroworks 

Tass Times in Tonetown 

The Tower of Myraglen 

Thexder 

Topdraw 

Type 

Typing Tutor IV 

Video Vegas 

Visualizer 

Where in USA is Carmen San Diego. . . 
Where in World is Carmen San Diego. 

Winter Games 

Wizardy 

Word Attack 

WordPerfect vil Spelling Checker- 

World Games 

Writer's Choice Elite 

Writer Rabbit 

Zork Trilogy 



$34.00 □ 
$27.00 □ 

$16.50 □ 
$16.50 □ 
$16.50 □ 
$32.00 □ 

$30,00 □ 
$27.00 a 

$34.00 a 

$46.00 a 
$24,00 D 
$23.00 a 
$23.00 □ 
$32.00 □ 
$27,00 D 

$27.00 a 

$24.00 □ 
$24.00 □ 
$24.00 P 
$24.00 D 
$24.00 □ 
$24.00 □ 
$24.00 □ 
$24.00 D 
$27.00 □ 
$14.00 □ 
$30.00 □ 
$24.00 D 
$32.00 D 
$23.00 D 
$66.00 D 
$30.00 D 
$32.00 a 

$18.00 a 

$53.00 a 

S3O.O0 □ 

$30.00 a 

$25.00 a 

$32.00 a 

$28.00 a 
$95.00 □ 

$25.00 a 
$60.00 a 

$24.00 D 
$46.00 □ 



$40.00 D 



$34.00 □ 
$30.00 □ 
$32.00 □ 



$24.00 □ 
$23.00 □ 

$32.00 □ 
$59.00 □ 

$27.00 D 



$95.00 D 
$27.00 D 



COMPUTIST 
is proud to 
offer these 
LOW software 
prices* for 
Apple II and 
llgs software 



* Prices subject to 
change without notice. 

Because we do not 'stock' but 
order only the software needed, 
the COMPUTIST Shopper keeps 
operating costs to a minimum 
and can pass the savings on to 
you. 

In most cases, your order is 
shipped within two weeks. The 
COMPUTIST Shopper will NOT 
cash your check nor charge 
your credit card until your 
software is ready to be shipped. 
If the software you ordered is 
not available, you will have the 
option to cancel your order, or 
make an alternative selection. 



How To Older 



• US orders: Check the box for 
your selection. For Apple llgs 
software, check the box in the 
right-hand column. 

• Please add $3 per order for 
shipping & handling. Orders over 
$200 receive free shipping. 

• Most orders shipped UPS, so use 
your street address. 

• Washington state, please add 
7,8% sales tax. 

• Offer good while supplies last. 

• Foreign Orders: Please inquire 
as to appropriate shipping fees 



Name_ 



JRT- 



Address 
City 



State 



Zip 



Country . 



.Phone. 



Exp. 



Signature. 



SoftKey Publishing PO Box 110816-T Tacoma WA 98411 



_CP57 



• Software 
SUBTOTAL _ 

• Plus 
SHIPPING _ 
(see above) 

• WA residents 
Sales Tax _ 
7.8% 

■ TOTAL 
Enclosed 
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eader's Data 



change 



Mike Basford 



Softkey for.. 




This patch will remove the copy- 
protection completely, as well as let TK! run 
as a stand alone program as was done with 
VISJCALC. 

First of all when I refer to the "B:" drive, 
if you have a hard disk you can substitute the 
appropriate drive letter for the "B;" drive. 
I also assume that the original "TK!" is in 
the "A," drive. 



I 1 I Format one System Disk under DOS 
2,0 or 2. 1 . Label it according to the original 
'TK!' diskette. 



2 | Copy the (unhidden) files from the 



original diskette to the corresponding 2.X 
formatted diskette. 



I 3 I Put the original 'TK! ' diskette in the 

"A:" drive 

Copy cod: B:SOFTARTS.(C) 

Enter: Tha t's all folks! 

Press HE then lENTERl 

You should see one fiie(s) copied 
message. This takes care of the hidden files. 

I won't tell you how to use debug or any 
'patcher' programs, I assume you have a basic 
understanding. I assume you have 
DEBUG.COM on a RAM or C: or CB: drive. 



I 4 | Now for some DEBUGing. 

DEBUG 

N A:TX.COM 

F CS:100 L EFFF 

L 

N B:TK2.C0M 

RCX 

:EFFF 

W 

Q 

BiDEBUG B;TK2,C0M 

E 951 90 90 90 His disables break point 

E 957 90 90 90 and stogie step overrides 

Note: The original TK! should now be in 
the "A:" drive 



Note: Program should stop at CS:511 

What we did was let TK! read all the 

other pieces of itself from the various disk 

sectors (the good and bad sectors), do all the 

decrypting and set up all areas. 

In otherwords we let it do all the work 
for us. We didn't even have to fool with bad 
tracks, or any decrypting ourselves. The 
reason for writing TK2.COM with a length 



of "EFFF" was to reserve this program area 
size so when TK! ran it would build all of its 
routines in "our" protected program area. We 
can then save TK2.COM as Tk3.COM with 
all of TK! safely stored in our protected TK2 
memory area. 

E 511 E8 

E 57C CC 

G 

E57CFF 

T 

R 

Note: At this point copy down all the 
registers and flag settings, (A shift PRTSC 
will do it for you.) 

RAXO 

RRXO 

R CX EFFF 

ROXO 

N B:TK3.C0M 

W 

RAXO 

R BX B230 

R CX AOOO 

RDX5898 

Note: at this point "BP" register had 
better be zeros. 



Press lENTERl since TK! is waiting 



it. 



Note: TK! should now come up as it 
normally would. 

I 5 I Now reboot the system with a DOS 
system disk in A drive, 

BiDEBUG B:TK3.C0M 

E 951 E8 46 FF Restore CNTL-BREM 

breakpoint 
E 957 E8 51 FF 



I 6 I What we will do next is bypass all 
the sector read code /decrypt logic since TK! 
has already done that once and put it in our 
protected program area that we saved as 
TK3.COM. 

Code that should be generated. 
A 252 MOV £1,1230 BE3012 

MOV DI.01QQ BF0001 

MOV AX,0 380000 

MOV BX.B230 BB30B2 

MOV CX,A000 BS00A0 

MOV DX.5898 BASSS8 

MOV SP.B2AD BCADB3 

MOV BP,© BD0000 

JMP BX FFE3 

M B:TX4.C0M 
W 
Q 



_7 | Place your original TK! in a safe 

place since we will no longer need it. Place 
disk with TK4.COM in "A:" drive or run 
from hard disk. 



TK4 

You should see the original copyright 
screen and the program will just sit there. You 
must press lENTBKl since the message 
"PRESS ENTER TO START" is now being 
bypassed. If all went well you now have an 
unprotected, decrypted, stand alone version 
of TK! solver. 

Note: all of the "TK!" copy protection 
is removed, and you may diskcopy (or copy) 
and rename TK4.COM to TK.COM to 
anywhere in the system your little heart 
desires. 

Other Notes: 

1 . Checks for specially formatted tracks 
are completely removed. 

2. You may load ail the files on the newly 
formatted and unprotected diskette directly to 
hard or RAM disk, in any sub-directory you 
set up. 

Softkey for... 



SYMPHONY ver 100 



Here how to wean SYMPHONY from 
it's master disk craving. 

Rename SYMPHONY.CMP SYMPHONY.XXX 

DEBUG SYMPHONY.XXX 

R Find the segment where loaded end add 

1000 to it. 

DS=0DFA xxxx=WFA 

(0DFAH+ 1000H= IDFAH) 
E mu:3A05 75 change INT 13 to INT 7SH 

(see label SYMINT below) 
W save changed tile 

Q exit DEBUG 

Rename SYMPHONY.XXX SYMPHONY.CMP 
SYMPH esecnte this program fit modifies the 

changed internpt back to 13H since 

SYMPHONY does a checksum ol itself) 
; assemble, link, EXE2BIN 

Execute this program before using 
SYMPHONY. There is no need to re-execute 
this program after exit from SYMPHONY, 
in order to use the SYMPHONY again, since 
it is a resident program. 

To further examine the symphony for 
possibly other ways to solve this, using 
DEBUG, do: 

DEBUG SYMPHONY.EXE 

G2 

T3 

G8A40 

T 

At this point you will find the subroutine 
that fills location ds:8735 with n and int 13 
(the second one) which reads the serial 
number from floppy disk in A. Zeroing 8735 
fools Symphony, and prevents it from testing 
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for special track/ sector structure on the 
floppy. If location 8735 is not zeroed, 
debugging will not be possible after IP 8A4D, 
since INT 3 will be modified by Symphony. 



SYMINT EQU 
SYMFLG EQU 

CSEG SEGMENT 



ORG 

PR0GRA:X0R 

MOV 

XOR 
MOV 

MOV 

MUL 
MOV 

TEST 

JZ 
INT 

DOIT: 

MOV 



MOV 

MOV 

MOV 

INT 

CORC : CL I 
PUSH 

PUSH 
PUSH 
MOV 
MOV 



MOV 



DEC 
MOV 



MOV 



POP 



75H interupt to use 
8735H see above for 
info 

Assume CS;CSEG, 
DS.CSEG 
100H 
AX, AX 

ES,AX set to segment 
(interupt table) 
DX.DX 

AL, SYMINT interupt 
number 

CX,4 get posi t ion in 
interupt table 
CX 

BX.AX 

WORDPTRES:[BX],0 
test if set? 
DOIT no, go set it 
20H exit to dos with 
ou t mod 

get interupt routine 
address 
word pt r 

ES: [BX] .offset core 
store it at the 
appropriateint 
address 

ES:[BX+2],CS also 
store the segment 
DX.5+16 length of 
this pgm in segments 
AX.3103H exit & stay 
resident 
21 H this is the 
actual interupt 

ES save alt used 

registers 

BP 

BX 

BP.SP 

ES, [BP+8J get 

ca! I ing segment from 

stack 

BX,[BP+6] get 

cat t ing address from 

stack 

BX back up one 

BYTE PTRES; [BX] , 13H 

store interupt 13h 

there 

BYTE PTRDS: SYMFLG, 

zero out the floppy 

test flag 

BX restore registers 



POP 


BP 


POP 


ES 


STI 




IRET 




back to 




symphony 


CSEG 


ENDS 



A Where are all the people who wrote and 
called to say that they had IBM cracks and 
to ask why we didn 't print those as well as 
Apple II info. ? We can only print what you 
send us. So take some lime and write to us. 
Our IBM editor has gone fishing and left 
a note for us to call him when we have 
something to edit. 
RDEXed 



Help 
Wanted 



The IBM RDEX editor desperately 
needs part-time writers. Any IBM 
experience will do. If you've used your 
IBM In some unusual way or solved 
some problems or just found 
something neat to do, write to the IBM 
RDEX editor and let him know. 

Tell your friends about the IBM RDEX. 
Put messages on all the bulletin boards 
you frequent. 

Get the word out! 

Send all contributions to: 

IBM-RDEX editor 

COMPUTIST 

PO Box 110846-T 

Tacoma, WA 98411 



COMPUTIST SUPER INDEX 

Looking for an easy way to find a particular softkey, APT, paying tip, or article in Computist 
without having to reread your entire Computist library? Want to save valuable time as well 
aseffort? Well, tiere is your solution: The COMPUTIST SUPER INDEX! 

This is a do la base that fists every softkey, update, partial, fix, bug, AP I playing rip, and 
article Computist has printed since its very first issue of Hardcore mogarine in 1983 . Well over 
1 S H 000 entries in over 2000 records! 

No more fumbling through trie back pages of all your Computisr magazines re find the articles,. 
tips, or scftkeys to your favorite programs. With the COMPUTIST SUPER INDEX you can find 
everything you want INSTANTLY and EFFORTLESSLY! 

FEATURES 

■ Lists all s&ftkeys, partial*, updates, fixes, and bugs, APT's. playing tips, and articles 
are included in a separate file. 

■ Nine Fields to search and sort from* Program Name, Distributor, Issue # r Pages, (if it 
uses a) Controller, (if the controller is) On SI OB (Controllers) Disk, Special Requirements, 
Bugs, and SaftkeyType. 

■ Special Requirements lists any special hardware, software, or previous softkeys required, 
and recommended articles - 

■ Softkey Type lists whether the softkey is a sector edit, DOS or binary patch, Baatcode 
trace, RWTS capture, on addition or alteration of a Basic or Hello program, if it uses a 
controller of has a hexdump, or any combination of these! 

■ Available in SIX formats: One large Applewcrks DB, ASCII Text, or DIF file for Apples 
and compatibles with at least 25oK of RAM, or in ttireesmallerAppleworksDfl. ASCI I Text, 
or DIF files. This allows you to access the data from all the popular data base programs, 
including Appleworks, DB Master, PFS File, and List Handler to mention o few. This comes 
on 5.25" diskettes formatted with PR0DO5 and is updated monthly. 

■ Quick reference cards, definitions, and additional information is supplied with each order. 



FOREIGN 

lstclass: $9.35 3r-dclass: 36.95 

$4.35 $2.95 



Please indicate RAM siie, plus format and shipping, desired. 

Send to: David R Hopkins 3495 W. HoyePlece Denver, CO 80219 



COST 


U.S. 


Index DB 


56.75 


Updates 


$2.75 
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unCLASSIFIED ADS 



Mind Prober— $9, Practicalc— $9 
Jingle Disk— $1, Cardware — $2 
PFS: Write, File, Report— $45 
Postpaid. Byion Blygtone, P.O. 
Box 1313, Snohomish, WA 9829CD. 

BIBLE WORKS 

The text of the entire King James 
version in Apple works W/P files. 
Set of seven 3Vz* disks — $69.95 
Texas residents add 7% sales tax 
LTE, Box 777, Refugio TX 78377 



Trade your unwanted software. 
Send your list of programs to trade. 
I have over 7ffl originals to tiade. 
Byron BIystone, P.O. Box 1313 
Snohomish, WA 98290. 

APPLE SALE!! 

Scribe Printer $149 

Modem 3<DIB $159 

8© column monitor $79 

Like new with cables and manuals 

(407)391-8429 

Wanted! Book of Apple Software 

1931-85 St Game ect. 

Prank Polosky PO Bx 9542 Pgh PA 

15223 



HELP: Softkey for 
Bank Street Writer Plus 
3 V2" Disk 
1 want to install this program 
on a RAM Disk. I need to 
defeat the Key Disk system 
Alan Zimbard, 91 Penn Rd 
Scarsdale. NY 1(D5 S3 

Print Shop Graphics 
Over 2<DO0 Public Domain 
graphics on 2© disk sides 
$16 95. FrintShop Graphics 
Box 1204 Toirington, WY 8224<D 

APPLE 1IGS 3.5" disk versions 
of "Runins of Keledoor" and 
"Trivia Pyramid" are now 
available! You've seen my ads 
here before. Now get these 
FASTER RUNNING 3.5" versions 
for your APPLE IIGS ■ both 
games for $3.95! The original 
released APPLE HE 5.25" 
versions are still available - 
both games only $8. Game 
booklets included. Send check 
or MO to Mark Whitehuist. 
Box 485, Franklin Park, IL 
60131. All orders rushed out! 



Essential for any Serious Deproiectlon Work I 



Graduate... 

to the Senior PROM! 



Wek 



Senior 
Prom 



w ®* 



2 

6 ^untnc^DGE 



A complete set of utilities 
instantly available in ROM to 
examine, modify, and hackun vour Appl^ software 
The Senior PROM is a hardware device with Machine 
Language utilities instantly available from any program: 

• Enter the Monitor to examine or change memory. 

■Display where in memory a program was running. 

■ Disassemble, view or save ANY memory. 

■Edit, search, and examine disks without booting DOS. 

■Initialize and copy disks without booting DOS first. 
All utilities in ROM & instantly available at any time! 
Sophisticated sector editor & memory /disk detective. 
Also, a program may be interrupted lo examine or alter 
memory, & then restarted, or saved to disk & restarted. 
Includes many Machine Langauage utilities such as Step 
and Trace, an Assembler, and more. Undetectable by 
any software or hardware, doesn't use a peripheral slot. 
Economically priced at $ 7 9 . 9 S for prepaid orders with 
check or money order. Credit card orders available for 
$88.95. Specify //c (without RAM expansion only), 
or //e (specify Standard or Enhanced ROMs). 



j^gg order* call 317-743-4041, 10-5 £.S.T. 

or 313-343-295^ Modtm g« Y\rs. M»t int<nd« Uf ilU^al m«. 



Cutting \_dge Enterprises 

43234c Ren Cen Station, Detroit, Ml 48243 



How to place an Unclassified Ad 

For short ads, use this order form. For larger ads, submit typed copy with appropriate 
instructions. Use every charactsr space, up to 30 characters per line, we will adjust word wrap. 
SB for the lirst line. 11 per line after that. 

Special Graphics Instructions: The first three words of the first line are printed in bold for free. 
If you want other words balded, use two spaces pel letter and circle the entire word. (Bold 
letters count as two letters.) If you went a line centered, write CENTER next to that line. There 
is no charge foi centering any line. 

S5 

$6 

$10 

Name _ m # 

Address ... , _^_^_ 

City ._ Stale Zip 

Coun t ry _ _ Phone . , 

mSm ^^F; . . Exp. 

Signature C PS3 

Total Number of lines: S 00 

Number of bold lines | nn 

STotal for a single ad $ 00 * 

Run my ad . number of times. Each run that I pay 

for now wiD cost me only Vz the total initial cost $ 00 

Final Total $ ,00 

•Washington orders add 7.8% sales tax Send this form and a check-money 
order [funds drawn on US bank only) for the entire amount to: 

COMPLTIST unCLASSlFIEDS PO Box 110846 Tacoma, WA 98411 




ONE MEG RAM BOARDS? 

WE'VE GOT EM! 

THE Super Expanders! 

S.E. llgs OK Now $49 

S.E. He "OK Now $59 

S.E. lie ' OK 1/38 $69 

S.E. II+ ' OK 3/88 $79 

Above with 256K = 
Above with 512K = CALL 
Above with 1MEG = 

* FREE Appleworks RAM 
Expansion Software! 

QUIET COOLING FANS1 

llgs No Audio Noise $25 

ll+/e w/Surge Protect $27 



OTHER PERIPHERALS! 

64K/80 Column Bd He S35 

Super 64K/80 Col lie $49 

16K RAM Board II+ $35 

128K HAM Board II+ $65 

80 Column Board it* $49 

Super Serial Bd ll+/e $49 

Z80 CP/M Board ll+/e $35 

Numeric Keypad lie $35 

Graphic Par Bd w/Cble $45 

Joystick $15 & $25 



A/B SWITCHBOX! 
Centronics or Serial 



$29 



ADD ON DISK DRIVE: 5% 

Specify Your Model $1 19 



TWO YEAR WARRANTY ON ALL PRODUCTS 

CALL OR WRITE FOR ILLUSTRATED LISTINGS! 

ADD S3 Shipping / COD ADD S2 I VISA/MC OKAY 0° 



NEXO DISTRIBUTION 

914 E. 8TH ST., Suite 109, National City, CA 92050 

(619) 474-3326 10AM-6PM Mon-Fri 
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The Hacker's Ultimate Copy & Deprotection Utility 

Super IOB Collection ! 



ALL of our Super IOB controllers (through 1986) in 'ONE' package! 



COMPUTIST developed the ultimate copy program to 
remove copy protection from software: 

The Super IOB program. 

Since the introduction of Super IOB, COMPUTIST has 
used this flexible program to deprotect {or partially 
deprotect) dozens of commercial programs with far 
ranging protection schemes. 

Super IOB deprotects disks by using a modified RWTS 
(the subroutine in DOS which is responsible for the 
reading and writing of disk sectors) for reading from the 
protected disk and then using a normal RWTS for writing 
to the deprotected disk. 

This package contains: 

►• TWO DISKS {supplied in DOS 3.3). Each disk contains at 
least 60 Super IOB Controllers including the standard, swap, 
newswap and fast controllers. Also included is version 1.5 of 
Super IOB, the Csaver program from COMPUTIST No. 13, and 
a Menu Hello Program that lists the available controllers and, 
when you select one, automatically installs it in Super IOB and 
RUNs trie resulting program.* 

*■ A reprint of Disk Inspection and the Use of Super IOB, 

from COMPUTIST No. 17. This article explains how to write 
your own Super IOB controllers. 

►- COMPUTIST No. 32, which contains an extensive article 
detaiiing the hows and whys of Super IOB v1.5 and at least 
5 articles using the new Super IOB program. 

• Several of the controllers deprotect the software 
completely with no further steps. This means that some 
programs are only minutes away from deprotection (with 
virtually no typing). 

• The issue of COMPUTIST in which each controller 
appeared is indicated in case further steps are required to 
deprotect a particular program.** 



The SUPER IOB Collection 

Volume 1 of the Super IOB collection covers all the controllers 
from COMPUTIST Wo. 9 through No. 26. Also included are the 
newswap and fast controllers from COMPUTIST Mo. 32. The following 
60 controllers are on volume 1: 

Advanced Blackjack, Alphabet Zoo, Arcade Machine, Archon II, 
Archon, Artsci Software, Bank Street Writer, Barrons SAT, 

Beyond Castle Wolfenstein, BSW lie Loader, Castle 
Wolfenstein, Computer Preparation: SAT, Dazzle Draw, DB 

Master 4 Plus, Death in the Carribean, Dino Eggs, DLM 

Software, Electronic Arts, F-15 Strike Eagle, Fast Controller, 

Fathoms 40, Financial Cookbook, Gessler Software, Grandma's 

House, The Heist, In Search of the Most Amazing Thing, Instant 

Recall, Kidwriter, Lions Share, Lode Runner. Mastertype, Match 

Maker, Miner 2049er, Minit Man, Mufplot, Newsroom, Newswap 

controller, Penguin Software, Print Shop Graphic Library, Print 

Shop, Rendezvous with Rama, Rockys' Boots, Sargon III, Sea 

Dragon, Shiela, Skyfox, Snooper Troops. Standard controller, 

Stoneware Software, Summer Games, Super Controller. Super 

Zaxxon, Swap Controller, TAC, Ultima I II, Word Challenge, 

Xyphus, Zaxxon 

Volume 2 of the Super IOB collection covers all the controllers 
from COMPUTIST No. 27 through No. 38. The following 65 controllers 
are on volume 2: 

Alice in Wonderland, Alphabetic Keyboard ing. Alternate Reality, 

Autoduel, Checkers, Chipwits, Color Me, Conan.data, 

Conan.prog, CopyDOS, Crisis Mountain, Disk Director, 

Dragonworld, Early Games, Easy as ABC, F-15 Strike Eagle, 

Fantavision, Fast controller, Fishies, Flight Simulator, Halley 

Project, Hartley Software (a), Hartley Software (b), Jenny of the 

Prarie, Jingle Disk, Kidwriter, Kracking Vol II, Lode Runner. 

LOGO II (a), LOGO II (b), Masquerade, Mastering the SAT, 

Microtype: The Wonderful World of Paws, Microzines 1, 

Microzines 2-5, Miner 2049er, Mist & View to a Kill, Murder on 

the Zinderneuf. Music Construction Set, Newswap controller, 

Olympic Decathlon, Other Side, Phi Beta Filer, Pitstop II, Print 

Shop Companion, RDOS, Robot War, Spy vs Spy, Standard 

controller, Sundog V2, Swap controller, Sword of Kadash, 

Synergistic Software, Tawala's last Redoubt, Terripin Logo, 

Threshold, Time is Money, Time Zone, Tink! Tonk!, Troll's Tale, 

Ultima IV, Wilderness, Word Attack & Classmate, World's 

Greatest Baseball, World's Greatest Football 






■ Yes, please send me The Super IOB Collection 

Includes both disks with Super IOB version 1,5, 
COMPUTIST #32, PLUS a reprint of "Disk Inspection 
and the Use of Super IOB". 

D US/Canada/Mexico for $16.00 
D Other Foreign for $20.00 

Send to: Super IOB Collection 

PO Box 110846-T Tacoma, WA 98411 

or call: (206) 474-5750 for EorHl orders. 

*Requires at least 64K of memory, 

** Although some controllers will completely deprotect the program 
they were designed for, some will not, and therefore require their 
corresponding issue of COMPUTIST to complete the deprotection 
procedure. 



Name_ 



JD#_ 



Address 
City 



State 



Zip 



Country 



Phone 



_Exp. 



Signature 



CP57 



Most orders are shipped within 5 working days, however, please allow 
4 to 6 weeks for delivery. Washington residents, please add 7.8% sales tax. 

US funds drawn on US banks 



July 
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HIlBHinHBS ffffHiT: 



Those days may he lony p-asl but On? Ir^asurE 



bas been diliueiitly Ir 



i rim [jfiqes of s motif 1 mi reference work 



The Book(s) of Softkeys 



Volume I Compiled from issues 1-5 

contains softkeys for: "Akalabeth •Amperroagic "Apple Galaxian "Aztec 'Bag of Tricks "Budge's Trilogy 
•Buzzard Bait "Cannonball Blitz 'Casino "Data Reporter 'Deadline "Disk Organizer II • Egbert II 
Communic. Disk "Hard Hat Mack •Home Accountant "Homeword * Lancaster « Magic Window II 'Multi- 
disk Catalog •Multiplan »Pest Patrol 'Prisoner II •Sammy Lightfoot • Screen Writer II • Sneakers "Spy's 
Demise 'Starcross 'Suspended •Ultima II *VisifUe "Visiplot *Visitrend •Witness •Wizardry *Zork I *Zork 
II 'Zork III G PLUS 'how-to' articles and listings of need-to-have programs used to make unprotected 
backups. 

Volume II Compiled from issues 6-1 

contains softkeys for: "Apple Cider Spider • Apple Logo • Artist Arcade Machine *Bank Street Writer 
•Cannonball Blitz "Canyon Climber "Caverns of Freitag "Crush, Crumble & Chomp 'Data Factory V "DB 
Master "The Dic*tion*ary "Essential Data Duplicator I & III "Gold Rush *Krell Logo 'Legacy of Llylgamyn 
■Mask Of The Sun •Mim't Man *Mouskattack "Music Construction Set "Oil's Well "Pandora's Box 
•Robotron "Sammy Lightfoot "Screenwriter II v2.2 "Sensible Speller 4,4c,4.1c "Spy Strikes Back "Time 
Zone vl.l "Visible Computer: 6502 «Visidex »Visiterm "Zaxxon • software for: 'Hayden "Sierra Online 
□ PLUS the ultimate cracking program: Super IOB 1.5 •••and morel 



III Compiled from issues 11-15 

contains softkeys for: 'Alien Addition 'Alien Munchies "Alligator Mix "Comp. Prep. SAT "Cut & Paste 
•Demolition Division. "DLM software *EA (Electronic Arts) software "Einstein Compiler 5.3 'Escape From 
Rungistan 'Financial Cookbook 'Flip Out 'Hi-res Computer Golf II "Knoware 'Laf Pak 'Last Gladiator 
•Learning With Leeper 'Lion's Share 'Master Type 1.7 'MatheMagic "Minus Mission "Millionaire "Music 
Construction Set "One-on-one 'Penguin software 'PFS software 'The Quest 'Rocky 's Boots "Sabotage 

• Seadragon 'Sensible Speller 4 'Snooper Troops II •SoftPorn Adventure 'Stickybear series "Suicide 
•TellStar »Tic Tac Show "Time Is Money "Transylvania "Type Attack •Ultima IU Exodus 'Zoom Graphics 

• Breaking Locksmith 5.0 Fast Copy PLUS feature articles on • Csaver • The Core Disk Searcher 

• Modified ROMs. 



Name . 



_ID#. 



Address _ 



City 



State 



Zip 



Country. 



_ Phone . 



Exp. 



□ Volume I - $7.95 
+$2 shipping/handling 

□ Volume II - $12.95 
+$2 shipping/handling 

□ Volume ffl - $17.95 
+ $2 skipping/handling 



Signature. 



□ All 3 volumes! - $30.00 
_CP57 +52 shipping /handling 



Foreign orders (except Canada and Mexico) please add $5 per book or $12 per set for shipping and handling. Washington residents 
add 7.8 % sales tax. Most orders are shipped within 5 working days, however, please allow 4-6 weeks delivery. US Funds drawn 
on US banks only. 

Send to: Book of Softkeys PO Box 110846-T Tacoma, WA 9841 1 (206) 474-5750 
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